GlobalProtect Internal Gateway and On-Demand

I'm trying to set up an Internal Gateway for GlobalProtect, and am finding that GP does not connect to the Internal Gateway if the Connect Method is set to "On-demand".  It works just fine if I set it to "Always-on".  Is this the way it's supposed to

DNS and global protect

I have a situation where global protect clients are dished out a DHCP address from the firewall but need an on-prem PTR created when they connect. does anyone have a good way to do this ?  

Valid web cert being flagged as invalid

Hi, has anyone ever run into an issue with a website's cert being flagged as invalid in the browser when connected to VPN? The website's cert is valid and everything works normally when not connected to VPN. Any input would be appreciated. 

Thanks

Automatically resetting preferred Gateway to "Best Available"?

Is there a way to automatically reset a GP client's preferred Gateway setting from the Portal?

I have gone from having multiple one-to-one Portal-Gateway setups, to a many-to-many setup where the GP client picks the best available Gateway based on ad