topic GlobalProtect enforcer exceptions not staying in registry in Next-Generation Firewall Discussions

GlobalProtect enforcer exceptions not staying in registry

Jagdeep1 — Thu, 30 Jan 2025 20:29:04 GMT

We have GlobalProtect with "Enforce GlobalProtect" enabled and a set of IP and FQDN exclusions. Additionally, the captive portal exception timeout is configured to 900 seconds. However, we’ve encountered an issue when users are connected to GlobalProtect, put their laptop to sleep, and then travel to a different location (e.g., a hotel). Upon waking up the laptop, users are unable to connect to any network, including those listed in the exclusions. The only workaround is for the user to restart the laptop in order to reconnect to the new network and GlobalProtect.

Upon further investigation, I found that the exclusions do not persist in the registry after the laptop is rebooted. They are only present in the registry while GlobalProtect is connected, which seems counterintuitive—especially since some of these excluded sites are necessary for GlobalProtect to function properly. This behavior persists across multiple versions of GlobalProtect (6.1.4, 6.1.5, and 6.2.5).

Re: GlobalProtect enforcer exceptions not staying in registry

ErinWest — Thu, 20 Feb 2025 17:04:51 GMT

We are having some of these issues as well and may explain what users have experienced. We are moving everyone to 6.2.7 but this just happened again for someone traveling.

Re: GlobalProtect enforcer exceptions not staying in registry

gnguyen2 — Thu, 27 Feb 2025 22:18:07 GMT

We are having this issue too. We have a case open with TAC but havent had much luck yet.

Re: GlobalProtect enforcer exceptions not staying in registry

thiagoRsilva — Mon, 15 Dec 2025 17:29:00 GMT

Hi.
Did you manage to find a solution to the problem?