GlobalProtect 6.3.3-1121 connects automatically despite on demand is enable

[A.Azhagesan]

Hello Team,

After upgrading GlobalProtect to 6.3.3-1121, we have noticed that Mac devices are automatically connecting to the VPN without any user intervention.

Is anyone else experiencing the same issue after upgrading to this version?

Please let us know if you have observed similar behavior

[EmirMujezinovic]

Yes, we are facing the same problem on the new version.

[batuhan.yilmaz]

we have the same problem in the 6.3.3-1121

[hbhbhb]

same here
we just upgraded yesterday, after testing an older 6.3.3 for a longer amount of time.... 😕

[JeremySchreiner]

Has anyone here found a solution to this.  So far we've just had to roll back to older version.  Only some users however have seen this, but unfortunately too many.  All are running Tahoe and are on m1 macs.  

[Smolli]

Just a quick update for anyone running into this: A clean reinstall did the trick for us.

Running the uninstaller via GlobalProtect-6.3.3-c1121.pkg, followed by a fresh install and a system reboot, resolved the issue on our end.

Worth noting: One user reported seeing a single reconnect right after the initial setup, but after manually disconnecting one more time, it stabilized completely without any further action. The client now stays disconnected as expected.

[J.Davidson963902]

Also seeing this issue. GlobalProtect is not even trying to log in to the portal in this case, it just keeps sending pre-logins directly to the gateway - can anyone else confirm whether this exact behaviour specifically is happening for them?

I'm getting a gateway-prelogin with SAML Request log message on the GlobalProtect logs every few minutes for affected users (which is to say all of them on version 1121 from what I can tell)

[J.Davidson963902]

I've had to tell users to disable GlobalProtect entirely when they don't need it. Just as a workaround (without adding further fuel to the flame by having BYOD users rollback then upgrade again later)

[J.Davidson963902]

Also I'd greatly appreciate if anyone could confirm that this behaviour did not occur in 1046, just in case I have to rollback (as we were on 676 before)