Hardware reference guide

GlobalProtect Administrator’s Guide 53
Set Up the GlobalProtect Infrastructure Deploy the GlobalProtect Client Software
Deploy Agent Settings Transparently
As an alternative to deploying agent settings from the portal configuration, you can define them directly from
the Windows registry or global MAC plist or—on Windows clients only—from the MSIEXEC installer. The
benefit of this is that it enables deployment of GlobalProtect agent settings to client systems prior to their first
connection to the GlobalProtect portal.
The following sections describe how to deploy agent settings transparently:
 Set the Portal Name
 Customizable Agent Settings
 Deploy Agent Settings from MSIEXEC
 Deploy Agent Settings in the Windows Registry or Mac plist
Set the Portal Name
If you do not want the user to manually enter the portal address even for the first connection, you can
pre-deploy the portal address through the Windows Registry: (
HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto
Networks\GlobalProtect\PanSetup
with key Portal) or the Mac plist (/Library/Preferences/com.
paloaltonetworks.GlobalProtect.settings.plist
and configure key Portal under dictionary PanSetup):
Settings defined in the portal configuration always override settings defined in the Windows
Registry or Mac plist. This means that if you define settings in the Registry or plist, but the portal
configuration specifies different settings, the settings the agent receives from the portal will
override the settings defined on the client. This includes login-related settings such as whether to
connect on-demand, whether to use SSO, and whether the agent can connect if the portal
certificate is invalid. Therefore, make sure that you do not define conflicting settings. In addition,
the portal configuration is cached on the client system and this cached configuration will be used
if the GlobalProtect agent is restarted or the machine is rebooted.