In an “always on” GlobalProtect configuration,
the agent connects to the GlobalProtect portal upon user logon to submit
user and host information and receive the client configuration.
It then automatically establishes the VPN tunnel to the gateway
specified in the client configuration delivered by the portal without
end user intervention as shown in the following illustration.
To switch any of the previous remote
access VPN configurations to an always-on configuration, you simply
change the connect method: