Ensure that the user is not expecting the upgrade process to happen before the GlobalProtect client is connected to their network. This upgrade will not take place until after the connection to its network has been made to avoid loss of productivity for the end-user. After the connection has been established, it will then begin the task of downloading the upgrade automatically and transparently in the background.
After the installation of the new version, the connection may drop and reconnect to establish a connection with the new client version. Also, verify if users are experiencing high traffic in their network. If there is a high traffic situation, some clients could fail to download the package. GlobalProtect will delay the task by a randomly determined interval (1 to 30 minutes). There is no guarantee that every download will succeed the first time, but it will succeed eventually.
The automatic update also depends on what the previous version was installed. If it is an older version, some existing information may have not been carried forward.
Note: The transparent upgrade will only work if the GlobalProtect user is running a lower GlobalProtect version than what has been activated on the firewall
Note: Make sure you have DNS records for the portal on your internal DNS servers so it can resolve to the portal address and be able to download the new client version.