In an “always on” GlobalProtect configuration,
the agent connects to the GlobalProtect portal upon user logon to
submit user and host information and receive the client configuration.
It then automatically establishes the VPN tunnel to the gateway specified
in the client configuration delivered by the portal without end
user intervention as shown in the following illustration.
any of the previous remote access VPN configurations to an always-on configuration,
you simply change the connect method: