If you are trying to upgrade your Palo Alto GlobalProtect APP and notice it’s not getting upgraded, a good place to look is at the PanGPA logs. If you look in the PanGPA logs and see the following errors:
(T14088) 03/08/19 17:31:50:199 Error( 292): CPanHTTPSession::SendRequest: WinHttpSendRequest failed with error 12007. (T14088) 03/08/19 17:31:50:199 Error( 149): DownloadURLToFile: download failed (T14088) 03/08/19 17:31:50:199 Error( 362): CPanHTTPSession::DownloadData: WinHttpQueryHeaders failed with error 12019. (T14088) 03/08/19 17:31:50:199 Error( 168): DownloadURLToFile: cancel download
Verify that DNS is working correctly for the Portals FQDN. You might also have to check the ACLs to ensure this traffic is allowed once you verify that DNS is working correctly.
To get the PanGPA logs, you need to go into the Global Protect client’s settings and click on “Troubleshooting“. Next, click “Collect Logs“. Save the file and extract it.