In an “Always On” GlobalProtect configuration, the app connects to the GlobalProtect portal (upon
user login) to submit user and host information and receive the client
configuration. The app then automatically connects and establishes a VPN tunnel to
the gateway that was specified in the client configuration delivered by the portal,
as shown in the following image: