Captive portal is a network security implementation where users connecting to a network (typically Wi-Fi) are first redirected to a web page for authentication before being allowed to establish a GlobalProtect secure connection to access corporate resources. This approach provides an additional layer of security by ensuring users authenticate through the local network's portal before the GlobalProtect client can establish a secure tunnel to the organization's network infrastructure. For information on enabling and configuring captive portal for end users, refer to Customize the GlobalProtect App.

When users are in proxy or tunnel and proxy (hybrid) mode, the captive portal login page may not load upon Wi-Fi connection because the proxy intercepts and blocks packets from reaching the captive portal. To ensure captive portal connectivity in these modes, it is recommended that you set Captive Portal Exception Timeout (sec) to 600 seconds. In addition, you must allow direct internet access (bypassing any proxy or filtering) for the connectivity check endpoint URLs: