In an “Always On” GlobalProtect configuration,
the app connects to the GlobalProtect portal (upon user login) to
submit user and host information and receive the client configuration.
The app then automatically connects and establishes a VPN tunnel
to the gateway that was specified in the client configuration delivered
by the portal, as shown in the following image: