In an on-demand
configuration, you must manually connect GlobalProtect through the
application. Traffic is routed through the GlobalProtect app only after you
initiate and establish the connection.
Per-App
In a per-app configuration, you can define which managed apps are
allowed to route traffic through GlobalProtect. To do so, you can attach a
VPN profile to an app, add URLs for the app you want access to, or do a
combination of both.