GlobalProtect enforcer exceptions not staying in registry

[Jagdeep1]

We have GlobalProtect with "Enforce GlobalProtect" enabled and a set of IP and FQDN exclusions. Additionally, the captive portal exception timeout is configured to 900 seconds. However, we’ve encountered an issue when users are connected to GlobalProtect, put their laptop to sleep, and then travel to a different location (e.g., a hotel). Upon waking up the laptop, users are unable to connect to any network, including those listed in the exclusions. The only workaround is for the user to restart the laptop in order to reconnect to the new network and GlobalProtect.

Upon further investigation, I found that the exclusions do not persist in the registry after the laptop is rebooted. They are only present in the registry while GlobalProtect is connected, which seems counterintuitive—especially since some of these excluded sites are necessary for GlobalProtect to function properly. This behavior persists across multiple versions of GlobalProtect (6.1.4, 6.1.5, and 6.2.5).

[ErinWest]

We are having some of these issues as well and may explain what users have experienced. We are moving everyone to 6.2.7 but this just happened again for someone traveling. 

[gnguyen2]

We are having this issue too. We have a case open with TAC but havent had much luck yet.