(Windows only) Connect Before Logon (CBL) does not connect when the GlobalProtect portal uses full-chain certificate verification and the portal and gateways are hosted on Prisma Access. When full-chain-cert-verify is enabled, all gateway connection attempts fail with the error "The network connection is unreachable or the gateway is unresponsive. Check the network connection and reconnect." When full-chain-cert-verify is disabled, a server certificate error prompt appears for the portal on each CBL attempt; after accepting the prompt, users must enter credentials a second time.

Workaround: Disable full-chain-cert-verify on the GlobalProtect portal. Note that users will encounter a server certificate error prompt on each CBL attempt and must enter their credentials twice to complete the connection.

(macOS only) GlobalProtect fails to connect when both the portal and gateway require OTP challenge authentication. After completing the portal OTP challenge, the gateway returns an HTML challenge response instead of the expected XML response, causing the connection to fail with the error "The network connection is unreachable or the gateway is unresponsive. Check the network connection and reconnect."