diff --git a/pkgs/tools/networking/openconnect/default.nix b/pkgs/tools/networking/openconnect/default.nix
index 132ae3cf0da0..421cec1a36f2 100644
--- a/pkgs/tools/networking/openconnect/default.nix
+++ b/pkgs/tools/networking/openconnect/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     urls = [
       "ftp://ftp.infradead.org/pub/openconnect/${name}.tar.gz"
     ];
-    sha256 = "00wacb79l2c45f94gxs63b9z25wlciarasvjrb8jb8566wgyqi0w";
+    sha256 = "00wacb79l2c45f94gxs63b9z25wlciarasvjrb8jb8566wgyqi00";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/tools/networking/openconnect_pa/default.nix b/pkgs/tools/networking/openconnect_pa/default.nix
new file mode 100644
index 000000000000..86e5c0aeb8b2
--- /dev/null
+++ b/pkgs/tools/networking/openconnect_pa/default.nix
@@ -0,0 +1,46 @@
+{ stdenv, fetchFromGitHub, pkgconfig, vpnc, openssl ? null, gnutls ? null, gmp, libxml2, stoken, zlib, autoreconfHook } :
+
+assert (openssl != null) == (gnutls == null);
+
+let
+  version = "7.08";
+  name = "openconnect_pa-${version}";
+in stdenv.mkDerivation {
+  inherit name;
+
+  src = fetchFromGitHub {
+    owner = "dlenski";
+    repo = "openconnect";
+    rev = "e5fe063a087385c5b157ad7a9a3fa874181f6e3b";
+    sha256 = "0ywacqs3nncr2gpjjcz2yc9c6v4ifjssh0vb07h0qff06whqhdax"; 
+  };
+
+  outputs = [ "out" ];
+
+  preConfigure = ''
+      export PKG_CONFIG=${pkgconfig}/bin/pkg-config
+      export LIBXML2_CFLAGS="-I ${libxml2.dev}/include/libxml2"
+      export LIBXML2_LIBS="-L${libxml2.out}/lib -lxml2"
+  '';
+
+  configureFlags = [
+    "--with-vpnc-script=${vpnc}/etc/vpnc/vpnc-script"
+    "--disable-nls"
+    "--without-openssl-version-check"
+  ];
+
+  postInstall = ''
+    # ldconfig
+  '';
+
+  nativeBuildInputs = [ pkgconfig autoreconfHook ];
+  propagatedBuildInputs = [ vpnc openssl gnutls gmp libxml2 stoken zlib ];
+  
+  meta = {
+    description = "OpenConnect client extended to support Palo Alto Networks' GlobalProtect VPN";
+    homepage = https://github.com/dlenski/openconnect/;
+    license = stdenv.lib.licenses.lgpl21;
+    maintainers = with stdenv.lib.maintainers; [ chessai ];
+    platforms = stdenv.lib.platforms.linux;
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 64422c346c6d..546e9be4240d 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -5976,6 +5976,10 @@ with pkgs;
     SDL = SDL_sixel;
   };
 
+  openconnect_pa = callPackage ../tools/networking/openconnect_pa {
+    openssl = null;    
+  };
+
   openconnect = openconnect_gnutls;
 
   openconnect_openssl = callPackage ../tools/networking/openconnect {