For beginning Linux users, installing the Palo Alto VPN might be a non-trivial process. However, the instructions for doing so are not impossible, especially if you are using a distribution such as Debian/Ubuntu or Fedora with more recognizable package managers.

Sourcing the VPN

According to the instructions from UC Berkeley's Library Website, you can source the GlobalProtect client from a Google Drive folder here (accessible to @berkeley.edu). You may also source it from other means, which you can try to find from the official installation instructions here.

Download one of the release tarballs and extract it using tar xvf PanGPLinux-<version number>.tgz, replacing <version number> with whatever version you downloaded. You should then see the following contents:

One of the tarball's contents from the Google Drive folder (as of May 29)

Dependencies

If you are planning to install the GUI, you will need to install the QT5 and QT5-webkit libraries, which can easily be installed from your package manager. I do not believe there are any special dependencies for the CLI tool itself.

Installation

Debian/Ubuntu

Luckily, you can install straight from the provided .deb files. There should be three .deb files: one for CLI only, one for ARM, and one for CLI + GUI. You will only need one! I recommend going for the CLI + GUI. Be sure to remember the file name.

The one-line install: sudo apt-get install ./<deb-file>.deb

You can also invoke the dpkg backend directly and resolve dependencies afterwards: sudo dpkg -i ./<deb-file>.deb && sudo apt-get install -f. If the one-line install does not work for you for whatever reason, use this instead.

Fedora

As with the Debian/Ubuntu instructions, there should be three .rpm files: one for CLI only, one for ARM, and one for CLI + GUI. You will only need one! I recommend going for the CLI + GUI. Be sure to remember the file name.

The one-line install: sudo rpm -i ./<rpm-file>.rpm

Arch Linux

I am currently writing a PKGBUILD file that will automate installation into one pkgbuild -si step. For now, follow the steps in "Other Linuxes".

PKGBUILD:

# In progress...

Other Linuxes

There will be three more tarballs (.tgz): one for CLI only, one for ARM, and one for CLI + GUI. Choose the one that fits best and extract it using tar xvf <tarball-file>.tgz.

Each release comes with an installation script, so you can simply run sudo make install to complete the process. This will install the tooling into /opt/paloaltonetworks/globalprotect by default. You will then have access to the CLI tool globalprotect.

For GUI users: If you use a graphical environment where .desktop shortcuts are accessible (this should be most graphical environments), you can copy the provided PanGPUI.desktop to your desktop and double click the file to launch the VPN tool that way.

Otherwise, you can invoke the GlobalProtect VPN interface through /opt/paloaltonetworks/globalprotect/PanGPUI . You can also symlink it to your binaries folder so that it is accessible via a shell, dmenu, etc. as follows:

sudo ln -s /opt/paloaltonetworks/globalprotect/PanGPUI /usr/bin/PanGPUI

In my configuration, I replaced /usr/bin/PanGPUI with /usr/bin/ucbvpn so I could invoke it using the alias ucbvpn instead.

Usage (GUI)

Just use this as normal. Open the GUI, use vpn.berkeley.edu, then sign in with your CalNet. Congratulations, you're now connected to Berkeley's VPN!

Uninstalling

Each release comes with its own uninstall script. You can either choose to uninstall using your package manager, or you can also extract the version you installed and run sudo make uninstall to uninstall.

Questions?

Please don't hestitate to contact me for questions at kmo@ocf.berkeley.edu.