iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Patch a Palo Alto GlobalProtect gateway as a controlled PAN-OS firewall maintenance change: confirm the exact supported release and prerequisites, update required content, patch a passive HA peer first when possible, fail over deliberately, and verify both firewall telemetry and a real client tunnel before declaring success. A same-train PAN-OS patch can be HOT, WARM, or COLD, so its user impact depends on the restart class. A feature-release upgrade requires the documented upgrade path and may require intermediate releases.
The safest runbook combines a configuration backup, an out-of-band administrative path, a defined rollback trigger, and a pre-change baseline for tunnel counts, failed connections, HA state, and active sessions. The procedure below covers standalone and Panorama-managed firewalls, active/passive HA sequencing, content timing, and endpoint validation.
What should you decide before touching the gateway?
Decide whether this is a same-train patch or a feature-release upgrade, identify the firewall or Panorama workflow, and define the maintenance and rollback windows before downloading software. Do not treat a PAN-OS upgrade as a routine GlobalProtect client update: it changes the firewall software that terminates tunnels, authenticates users, assigns client addresses, and enforces traffic policy.
Same-train patch or feature-release upgrade?
| Change | Use when | Procedure and impact | Rollback |
|---|---|---|---|
| Same-train PAN-OS patch | A critical bug or CVE fix is available for the installed feature train | In Device > Software, select Check Now, enable Include Patch, inspect View More Info, download, install, and apply. Palo Alto classifies the restart as HOT (web-interface refresh), WARM (process restart), or COLD (firewall reboot). | Use the documented Revert action to remove the applied patch fixes if the release procedure permits it. |
| Feature-release upgrade | You need a newer PAN-OS feature train or the fix is not available on the current train | Follow the supported upgrade path and install every required intermediate feature release. Review release-specific notes, content minimums, GlobalProtect agent minimums, plugins, known issues, and restart requirements. | Use the target release’s downgrade guidance; do not assume the same-train patch Revert action applies. |
A patch may reduce downtime, but HOT does not mean every tunnel remains unaffected in every topology. Confirm the restart classification in View More Info and schedule the change around the observed gateway and HA behavior in your environment.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
Standalone, Panorama-managed, or HA?
On a standalone firewall, software and content actions are performed locally. If Panorama manages the estate, use Panorama > Device Deployment > Software; Panorama separates software Download, Install, and GlobalProtect client Activate actions, while dynamic content updates are installed separately. An HA pair must be handled one peer at a time. Active/passive sequencing is described below; active/active pairs need the release-specific HA procedure rather than an assumption that active/passive steps transfer directly.
What must be in the preflight checklist?
Complete the following checks on the exact gateway and target release. Record the output, not just a pass/fail, so you have a meaningful comparison after the change.
Record the operational baseline
- Current PAN-OS version and target version, including the exact patch identifier.
- Installed GlobalProtect client package, plugin versions, and relevant content versions.
- HA mode, peer roles, synchronization state, and whether preemption is enabled.
- Active sessions, current GlobalProtect tunnel count, maximum-concurrent-tunnel telemetry, and the normal failed-connection rate.
- Recent authentication failures, tunnel-establishment failures, client IP-assignment issues, and HIP-event anomalies.
Capture the baseline immediately before maintenance and retain it with the change record. The gateway summary commands expose maximum concurrent tunnels and failed GlobalProtect gateway connections, making those metrics useful for before-and-after comparison.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteValidate licensing, access, and capacity
- Confirm the firewall is registered and licensed, including the support entitlement and Customer Support Portal access needed to obtain the software.
- Check available disk space before downloading or installing. A release can fail before reboot if the image or extracted files cannot be stored.
- Verify that the firewall can reach the Palo Alto update server through the management path. If an intermediary firewall, proxy, or DNS policy is involved, test that path from the device rather than from an administrator workstation.
- Prepare a configuration backup and an out-of-band administrative path such as console or a separate management route before any reboot.
The documented upgrade mechanics do not guarantee automatic recovery for every deployment. Treat the backup and alternate access path as operational controls, and test that you can retrieve the backup without relying on the VPN being upgraded.
Read the target release notes
Read the release notes for the exact target branch. Check known issues, addressed CVEs, upgrade and downgrade restrictions, required content versions, minimum GlobalProtect agent versions, plugin minimums, and any special reboot or HA instructions. Requirements are release-specific; a rule from another PAN-OS branch is not a valid substitute.
Confirm the client population can connect
Verify the minimum GlobalProtect agent version required by the target release. Palo Alto explicitly warns that failing to meet this minimum can cause users to lose VPN connectivity. Inventory managed and unmanaged endpoints, including Linux clients, and identify any population that cannot be upgraded during the maintenance window.
How should content updates be timed?
Update required content before updating PAN-OS. Each PAN-OS release has a minimum supported content version, so installing the firewall software first can leave it outside the documented compatibility range.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Review and stage content safely
Read the release notes for Applications, Threats, antivirus, and other content packages that the target release requires. Palo Alto recommends a staggered rollout to lower-risk locations first. In a security-first network, use a six-to-twelve-hour observation threshold before expanding a content update when your change policy allows that delay.
For mission-critical applications, the documented example is a minimum 24-hour threshold for Applications or Applications and Threats updates. This is a waiting threshold for observing impact, not a promise that every environment needs exactly 24 hours.
Schedule downloads without collisions
Scheduled content updates should be staggered because a firewall downloads one update at a time. Separate large or security-sensitive packages so a delayed download does not block another required update. Confirm that the final installed content versions meet the target PAN-OS minimum before starting the software operation.
How do I apply a same-train PAN-OS patch?
Use the local Device workflow, inspect the patch details, and treat the restart class as the source of truth for expected impact.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Open Device > Software.
- Click Check Now, then enable Include Patch.
- Locate the target patch and select View More Info. Read the bug and CVE scope, restart classification, prerequisites, and any release-specific warnings.
- Confirm that the current PAN-OS train, disk space, content versions, licensing, and GlobalProtect agent minimum satisfy the notes.
- Click Download and wait for the image to complete. Do not start a second software download on the same device while this one is active.
- Click Install, review the confirmation, and select Apply when the interface presents that action.
- Observe the management interface and HA state through the out-of-band path. Do not treat a returning web page alone as proof that GlobalProtect tunnels or application traffic are healthy.
Palo Alto describes a PAN-OS software patch as a way to apply bug and CVE fixes without scheduling a prolonged maintenance, but the actual interruption still depends on whether the patch is HOT, WARM, or COLD and on your HA design.
How do I upgrade PAN-OS when a feature release is required?
Follow the supported path exactly; skipping a required feature release can make the upgrade unsupported or fail during installation.
- Use the target release notes and upgrade guidance to list every required intermediate release.
- Confirm the required content level before each software step, updating content first whenever the procedure calls for it.
- Download and install one feature release at a time, allowing the firewall to complete its reboot and health checks before proceeding.
- After each intermediate release, verify management access, HA state if applicable, GlobalProtect gateway status, and representative traffic before continuing.
- Keep the downgrade instructions for the target release with the change record. Feature-release rollback is not the same as reverting a same-train patch.
How should I patch an HA pair without dropping all users?
Patch one peer at a time, fail over deliberately, and verify traffic and synchronization before touching the second peer. Active/passive pairs provide the clearest sequence; active/active deployments require the exact procedure for that release and topology.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Active/passive sequence
- Confirm which peer is active and which is passive. Record HA state, session counts, tunnel counts, and traffic behavior.
- Where the platform and release procedure allow it, download and install the patch on the passive peer first. Wait for it to return in the expected passive state and confirm that management access is stable.
- Suspend the active peer so traffic fails over to the upgraded peer. Confirm that the new active peer is passing traffic and that representative GlobalProtect users can authenticate and establish tunnels.
- Patch and reboot the former active peer. When the procedure requires it, run
request high-availability state functionalon the upgraded peer. - Verify that both peers are passing traffic as expected for the topology and that HA2 counters and session synchronization are advancing normally.
- Leave preemption disabled during the observation period if you disabled it for maintenance. Re-enable it only after stability checks and after confirming which peer should become preferred.
Do not proceed to the second peer merely because the first peer is reachable. A reachable management plane with unsynchronized sessions or non-passing dataplane traffic is a stop condition.
Free tools Windows power users keep installed
One-click scans. No signup required.
What changes in active/active HA?
Active/active pairs distribute traffic differently and have different ownership and failover behavior. Use the target PAN-OS release’s active/active upgrade procedure, identify the expected role of each peer during maintenance, and verify both dataplanes and HA synchronization before continuing. Do not infer an active/active sequence from the active/passive steps above.
How do I verify the gateway from the firewall?
Use the CLI, traffic evidence, and service logs together. A single “connected” counter can miss authentication loops, client IP exhaustion, or a tunnel that exists but cannot pass the required application traffic.
Run the GlobalProtect gateway commands
At the firewall CLI, start with the summary and then narrow the check to the named gateway:
show global-protect-gateway summary all
show global-protect-gateway summary detail name <gateway>
show global-protect-gateway statistics gateway <gateway> domain <domain>Use the current-user and flow branches when validating a particular user or tunnel:
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →show global-protect-gateway current-user ...
show global-protect-gateway flow name <gateway>The exact sub-options under current-user vary by PAN-OS version, so use the CLI’s context-sensitive help for the gateway and domain names in your configuration.
Compare metrics with the baseline
- Compare current tunnel counts with the pre-change count and normal peak range.
- Compare failed GlobalProtect gateway connections with the recorded baseline; a material increase is a rollback or stop trigger.
- Check that the maximum-concurrent-tunnel telemetry is plausible for the population that should be online.
- Use Monitor > Session Browser, or the equivalent traffic evidence, to confirm that sessions are being created and bytes are passing through the expected interfaces and security rules.
- On an HA pair, inspect HA2 counters and session synchronization rather than relying only on peer state labels.
Read the GlobalProtect service log
Review gpsvc.log for authentication, tunnel establishment and teardown, client IP assignment, and HIP events. Palo Alto’s device-health metric reference identifies this as the GlobalProtect service log source: GlobalProtect service metrics and logs.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
How do I verify a real endpoint tunnel?
Validate at least one real client after the firewall-side checks. The endpoint confirms the complete path from authentication through tunnel creation, address assignment, routing, and application access.
GlobalProtect app
Open the app’s Connection view and record:
- Gateway name.
- Tunnel status.
- Authentication status.
- Connection type.
- Gateway address or FQDN.
- Connection uptime.
Use a client that represents the normal user population, not only an administrator workstation. If the deployment has multiple gateways or domains, test a location that exercises the failover or selection behavior used by ordinary users.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchLinux command-line client
On Linux, run:
globalprotect show --status
globalprotect show --detailsA healthy documented example reports GlobalProtect status: Connected, an assigned IP address, gateway IP address, protocol, and uptime. Record those values and compare the assigned address and gateway with what the firewall shows for the same user.
Test the traffic users actually need
- Open at least one internal application that the user is authorized to reach.
- Resolve an internal DNS name and confirm the answer comes from the expected resolver path.
- Check the expected split-tunnel or full-tunnel routing behavior from the client.
- Confirm that the application session appears in the firewall’s traffic evidence.
- Record the result, timestamp, client version, gateway, and connection type for the change record.
A tunnel can be established while an internal application remains unreachable, so treat application, DNS, and routing checks as separate tests.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.When should I stop or roll back?
Stop the rollout or roll back when the post-change evidence shows a service regression, not merely when an administrator interface is slow.
- The gateway cannot authenticate users who passed the pre-change test.
- Tunnel establishment fails or clients repeatedly reconnect.
- Failed-connection telemetry rises materially above the recorded baseline.
- HA peers do not synchronize, HA2 counters remain abnormal, or sessions are not being replicated as expected.
- Traffic does not pass through the expected interfaces or security policy.
- Clients show a connected state but cannot resolve required DNS names or reach an authorized internal application.
For a same-train patch, use the documented Revert action when the release procedure supports it, then repeat the firewall and endpoint checks. For a feature-release upgrade, follow the target release’s downgrade guidance and preserve the evidence that triggered the rollback. Do not start the second HA peer while any of these conditions remains unresolved.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →How do I troubleshoot common verification failures?
Users authenticate but no tunnel appears
Compare the endpoint’s authentication status with the gateway’s current-user and service-log entries. Check whether the client meets the target release’s minimum agent version, whether a client IP was assigned, and whether the gateway summary shows failed connections rather than completed tunnels.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
The tunnel is up but internal applications fail
Use Session Browser or equivalent traffic evidence to determine whether packets reach the expected interface and policy. Test DNS separately, then verify whether the observed route matches the deployment’s split-tunnel or full-tunnel design; a connected status alone does not prove that application traffic is taking the intended path.
The upgraded HA peer is online but synchronization is unhealthy
Keep the peer out of normal preference until HA2 counters and session synchronization are healthy. Confirm that both peers are on the intended software and content levels, inspect the HA state and logs, and follow the release-specific recovery procedure before re-enabling preemption.
Connection failures spike after content deployment
Stop expanding the staggered rollout and compare the timing of the failures with the content package installation. Use the documented observation threshold for the affected package, review its release notes, and revert or defer the content change according to the content procedure before changing PAN-OS again.
What should the completed change record contain?
Close the maintenance only when the evidence is reproducible and attributable to a specific device, peer, and client.
- Original and final PAN-OS, content, GlobalProtect client, and plugin versions.
- Patch or feature-release identifier, restart class, start and finish times, and operator.
- HA roles before and after, failover time, preemption state, and HA2/session-synchronization results.
- Pre-change and post-change tunnel counts, maximum-concurrent-tunnel observations, and failed-connection rates.
- Firewall command output, relevant
gpsvc.logfindings, and traffic evidence. - Endpoint gateway name, tunnel and authentication status, assigned IP, protocol, uptime, DNS result, application test, and routing result.
- Any rollback decision, trigger, action taken, and final disposition.
This record gives the next operator a known-good comparison point instead of relying on a vague statement that the firewall “came back up.”
Frequently Asked Questions
Can a HOT PAN-OS patch still interrupt GlobalProtect users?
Yes. HOT means the web interface refreshes without the restart behavior of a WARM process restart or COLD firewall reboot, but tunnel impact still depends on the gateway, HA design, and patch procedure. Verify the restart classification in the patch details and test a real endpoint rather than assuming zero disruption.
Do GlobalProtect clients need to be upgraded before the firewall?
Only clients below the target release’s documented minimum need action, but you must identify them before maintenance. Palo Alto’s upgrade checklist specifically calls for verifying the minimum agent version because incompatible clients can lose VPN connectivity.
Should content updates be installed at the same time as PAN-OS?
Install required content before PAN-OS, but do not bundle every optional content change into the same risk window. Use staggered deployment and the applicable observation threshold, especially for mission-critical Applications or Applications and Threats updates.
What evidence proves an HA failover was successful?
You need more than a changed active/passive label: the upgraded peer must pass traffic, representative users must establish tunnels, and HA2 counters and session synchronization must behave normally. Confirm those conditions before patching the remaining peer or restoring preemption.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
