Meaning of GP app setting "Have User Accept Terms Of Use before Creating Tunnel"

[Deepak25]

What is the meaning of GP app setting "Have User Accept Terms Of Use before Creating Tunnel" , for which purpose this option is useful ?

[mkroell1]

I would like to understand this setting as well.

[GregTaylor]

Agreed, the setting doesn't seem to change any behavior, despite the documentation - https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-web-interface-help/globalprotect/network-global...

[EddieHerrera]

I found that on version 11.1.6 this works as intended.

You must have a welcome page configured on the firewall. The default welcome page, found in Device -> Response Pages -> GlobalProtect App Welcome Page can be exported and customized to suite your requirements. In my case I uploaded and pushed it with panorama after exporting it from the local firewall to customize. 

Then you can select the GlobalProtect App Welcome Page from the GlobalProtect Portal configuration. This can be found in Network -> Portals -> PortalName -> Agent -> AgentConfig -> App -> Welcome Page (on the right side of the configs window). Additionally under the App Configuration Section of the Configs window, you need to set "Have User Accept Terms Of Use before Creating Tunnel" to Yes.

These changes will result in a pop-up window appear to a user after they authenticate to Global Protect. It will prompt them to click I Agree or Decline. In my testing, you must click I Agree to establish a tunnel. 

Here is what the window looks like. 

Hope this helps. 

EJ