Access Keys:
Skip to content (Access Key - 0)

Install and Connect to the Prisma Access VPN on Linux


The official GlobalProtect GUI client, which is required for touchstone auth, only supports a narrow range of Linux Distros. Please see here for the authoritative list.

For other distros it is possible to get openconnect to work using community projects, but please note that this is not officially supported by Palo Alto or IS&T.

Official Client


Download the MIT GlobalProtect Linux app. It includes the following files (you will NOT use them all):

  • GlobalProtect_UI_tar-
  • GlobalProtect_UI_rpm-
  • GlobalProtect_UI_deb-
  • GlobalProtect_tar_arm-
  • GlobalProtect_tar-
  • GlobalProtect_rpm_arm-
  • GlobalProtect_rpm-
  • GlobalProtect_deb_arm-
  • GlobalProtect_deb-

    (ONLY use the "UI" installation packages, the non-UI versions will not work with SAML.)
    Use the *.deb version for Debian-based distros (Ubuntu, Linux Mint, etc.), use the *.rpm version for Red Hat based distros (RHEL, CentOS, etc.) and use the generic tar for other distros (Arch, etc.)
    The *.deb and the *.rpm should be opened with the system package installer of your choosing (i.e. by double clicking the file and following the prompts.)

Manual Install:

  1. Extract the installation files:
    mkdir GP_VPN_UI && tar xf GlobalProtect_UI_tar- -C GP_VPN_UI
  2. Obtain root privileges and run the installation script:
    sudo bash GP_VPN_UI/

    Result: This will attempt to install the sole dependency (qt5-webkit) but this will only work on Debian based, or Red Hat based distros. If this fails for you, please search your package repositories for the appropriate packages, which e.g. for Arch is extra/qt5-webengine.

    ? sudo bash GP_VPN_UI/
    sudo password for <username>:
    systemd is detected.
    Enable gp service...
    Create symlink for gp cli...
    Starting gp service...
    Enable gp autostart...
    Starting gpa...
    Check for and install PanGPUI dependencies...
    wget: download QtWebkit...
    yum: Installing QtWebkit dependencies...
    Starting gpui for <username>...

    Result: The GlobalProtect App is installed and immediately prompts you to connect (continue below).


  1. Click on the globe icon in your taskbar if it is not already open.

  2. Enter the address:
  3. Click Connect.
  4. Authenticate using Touchstone Authentication.
    Result: You're connected to MIT GlobalProtect VPN service and may go about your computing activities normally. The globe icon now includes a shield.

After the first time you connect, simply click on the globe icon in your taskbar and tap the Connect button to connect. You may be prompted to authenticate again depending on how long it has been since your last connection.


  1. Click on the globe and shield icon in your taskbar.

  2. Click the Disconnect button.
    Result: You have been disconnected from the MIT GlobalProtect VPN service.

Unofficial Solutions


Standard VPN client openconnect supports Global Protect, but requires a community tool to handle the Touchstone auth steps.

See: GlobalProtect-openconnect

This will allow you to negotiate the SAML auth, get the cookie you need, and use openconnect to tunnel traffic.

The only caveat is sometimes it doesn't like the load balancer, so instead you need to manually use a particular gateway, so e.g. for US East, use:

See Also

IS&T Contributions

Documentation and information provided by IS&T staff members

Last Modified:

September 28, 2023

Get Help

Request help
from the Help Desk
Report a security incident
to the Security Team
c-prisma c-prisma Delete
linux linux Delete
vpn vpn Delete
gp gp Delete
global global Delete
protect protect Delete
globalprotect globalprotect Delete
gpvpn gpvpn Delete
Enter labels to add to this page:
Please wait 
Looking for a label? Just start typing.
This product/service is:
Easy to use
Difficult to use

This article is:
Adaptavist Theme Builder (4.2.3) Powered by Atlassian Confluence 3.5.13, the Enterprise Wiki