Windows Installation Instructions

Antivirus required to connect. Please click here for details.
SUPPORT NOTES
  • Do not use these manual installers on LLNL-managed computers; use Portal Manager or MacPatch instead.
  • GlobalProtect will open your system default web browser to complete the authentication process.
GlobalProtect


GlobalProtect Client

Setup Instructions

NOTE: The appearance and verbiage of the pictures below may change over time as we improve them for clarity/etc. While we endeavor to keep these instructions clear and up-to-date, Palo Alto Networks also provides regularly-updated instructions at their own site:
Palo Alto Windows Installation Instructions
Using Connect-Before-Logon
Using GlobalProtect
  1. You need to install this client as Administrator. Navigate to the folder where you saved the downloaded file and run as Administrator. When you open the file the GlobalProtect Client Setup Wizard screen appears.
  2. Run the installer, click "Next", "Next," "Finish" etc. to accept the defaults:



  3. Once the software is installed successfully, the GlobalProtect VPN window should pop up automatically. If not, click the small arrow in your taskbar (lower-right corner of your screen) and click the grey GlobalProtect "Globe" icon. Click install to begin the installation.



  4. In the GlobalProtect window, enter the LLNL VPN portal address: gpvpn.llnl.govClick "Connect".



  5. A login window will now appear in your default web browser. Select whichever option is most convenient for you, and one that corresponds to a device you already have (i.e., don’t choose ‘DOE PIV Card’ if you don’t have one).
    • MyPass
    • DOE PIV Card (badge with embedded chip)
    • RSA (SecurID, also known at LLNL as the One-Time Password, or OTP)




  6. If you choose RSA, enter your OUN in the Username field and your OTP (PIN + token code) in the Password field that appears on the next screen. Proceed to step 7.
    If you choose MyPass or PIV, you will be prompted to select the proper certificate:
    • For MyPass, choose the certificate with your official username somewhere in the subject.
    • For PIV, choose the certificate with your name in uppercase letters. It might also say ‘Affiliate.’


    A window showing a dialog box to select a certificate.

    1. Enter your PIN and press OK/Continue:

      A Windows Security prompt showing a dialog to enter in the user's PIN.

      NOTE: If you are using Firefox and not getting a prompt for a valid certificate, you may be able to resolve your issue by going to “Settings > Privacy & Security > Security > View Certificates… > Authentication Decisions” , select any value where the host contains the term “eidp” and Delete, then reload your browser/reboot and try again:
      A dialog box showing a list of certificates for a user to delete

  7. Once you authenticate successfully, your browser will display the following window:

    An alert from Palo Alto Networks that confirms authentication was successful

    Follow the instructions given and select “Open GlobalProtect” if you see a system dialog prompt (at which point you can choose to Always Remember) or click the “click here" link to launch the GlobalProtect client and complete the connection.

  8. If you do not pass the antivirus software enforcement check, you will not be able to reach any LLNL resources and will receive a pop-up window instructing you to remediate your computer and reconnect:



  9. To disconnect the GlobalProtect VPN software, click the "Globe" icon in the system tray, then click the "Disconnect" button.