In an “always on” GlobalProtect configuration,
the agent connects to the GlobalProtect portal upon user logon to submit
user and host information and receive the client configuration.
It then automatically establishes the VPN tunnel to the gateway
specified in the client configuration delivered by the portal without
end user intervention as shown in the following illustration.