GlobalProtect users losing network access some minutes after being connected

• GlobalProtect (GP) users experience intermittent connectivity issues for 2-3 minutes after tunnel establishment.
• New connections cannot be established, even though the GlobalProtect connection status remains 'Connected'. 
• Existing HTTPS, HTTP, and RDP connections may continue to work.
• For example, once the user is connected to GlobalProtect, ip-user mapping with GP as the source is created in the firewall:

• When the same user logs to an application with a different account on the same machine (like shared network files through SMB), GP ip-user mapping gets overwritten with new username received via Agentless User-ID on the firewall:

• Even when GP is still connected, users can experience loss of access to network resources due to security policy and User-ID mismatch. For instance, user1 is not included in the same security policy than user12:

• Palo Alto Firewalls
• Supported PAN-OS versions
• GlobalProtect App

Add GP IP pools to exclude networks on User Identification settings.

GUI: Device > User Identification > User Mapping > Include/Exclude Networks

Similar article : Issue with ip-user-mapping in mixed environments of GlobalProtect and user-ID agents.