In an “always on” GlobalProtect configuration,
the agent connects to the GlobalProtect portal upon user logon to
submit user and host information and receive the client configuration.
It then automatically establishes the VPN tunnel to the gateway specified
in the client configuration delivered by the portal without end
user intervention as shown in the following illustration.