misleading IOS Notification - "Globalprotect Always-On mode is enabled. Please sign in to continue"

[RREALICA]

We are currently testing Globalprotect for IOS and we are seeing this notification in the phones - "Globalprotect Always-On mode is enabled. Please sign in to continue"

Everything is working as expected in our test setup which is on-demand, using Azure SAML for authentication with client certificate - the one thing we don't understand or not make sense is the misleading notification that pops-up; this gets triggered if try to connect the VPN via Settings > VPN.

Launching the Globalprotect client manually and login from there is working as expected.

We don't see any configuration that is being pushed via MDM or via the GP Agent that would indicate "always-on" is enabled. 

Anybody else seeing the pop-up? Is there a way to control/configure it? 

[bink_hugo]

We are running into the same issue on iOS with Global Protect set to "On-demand" and using Per-app VPN from Intune. Haven't found a way to disable it yet.

[FrankdeWaard]

Hi,

I know this thread is quite old, but since it was the only thing referencing the issue we're having I'd like to share the info I got from Palo Alto Support.

See below for the response. It is a known issue which is fixed in 6.1.0.

I checked internally and found that this is a known issue which is fixed in Global Protect version 6.1.0 under GPC-17435
Kindly check the below document for reference:
GlobalProtect 6.1.0 Addressed Issues (iOS & Android)
> https://docs.paloaltonetworks.com/globalprotect/6-1/globalprotect-app-release-notes/globalprotect-ad...

Regards, Frank.