In a remote access (On-Demand) VPN configuration, users must manually launch the GlobalProtect app to establish the secure GlobalProtect connection. The GlobalProtect app connects to the GlobalProtect portal (upon user login) to submit user and host information and retrieve the agent configuration. After the app receives the agent configuration from the portal, it connects and establishes a VPN tunnel to the GlobalProtect gateway that was specified in the agent configuration.

Refer to the following sections for information on how to configure a user-initiated remote access VPN configuration using supported mobile device management systems: