Windows Clients – Captive Portal Not Triggering with GlobalProtect Always-On Enabled

[bilal_guclu]

Hello everyone,

We are using a Captive Portal on our Palo Alto firewall at the headquarters. When users enter the building and connect to the wireless network, a Captive Portal pop-up is presented, and users gain internet access after entering their username and password.

At the same time, our end users are operating under a GlobalProtect Always-On architecture, where internet access is restricted unless the VPN is connected.

The issue we are facing is the following:

• Only Windows users report that the Captive Portal does not appear when they arrive at the office and connect to Wi-Fi

• If we disable Always-On for the affected users, or uninstall and reinstall the GlobalProtect client, the issue is resolved

• In some cases, the issue only resolves after multiple system reboots

We have already:

• Allowed access to Captive Portal-related IPs/FQDNs so that users can reach them even when VPN is not connected

• Confirmed that this behavior only occurs on Windows endpoints (macOS users are not affected)

Despite these steps, the problem still persists.

Has anyone experienced a similar issue with GlobalProtect Always-On on Windows in combination with a local Captive Portal?
If so:

• Was this related to Windows network detection (NCSI), captive portal detection, or GlobalProtect pre-logon / always-on behavior?

• Are there any recommended workarounds, registry settings, or known bugs?

• Did a specific GlobalProtect agent version resolve this issue?

Any suggestions or shared experiences would be greatly appreciated.

Thank you.