GlobalProtect user tunnel shows pre-logon IP address instead of dedicated user's IP pool

• GlobalProtect tunnel for users is retained with the IP pool from the "pre-logon" tunnel
• Security Policies based on source IPs are not correctly applied

• Palo Alto Firewalls
• Supported PAN-OS versions
• GlobalProtect (GP) Gateway
• GlobalProtect App
• Supported client versions
• Windows Clients

• This behavior depends on the value selected for Pre-Logon Tunnel Rename timeout . (Network > GlobalProtect Portals > <portal-config> > Agent > <agent-config> App)
• If "-1" is entered, GP renames the tunnel to reassign it to the user.
• However, the tunnel would persist if the renaming fails or if the user does not login to the GP gateway.

1. Select "0" for "Pre-Logon Tunnel Rename timeout" option to terminate the tunnel after user logs in to the machine.
2. After the user successfully authenticates, a new IP from the dedicated user's IP pool would be assigned.

1. Select Refresh Connection from the GP app, to establish a new tunnel from scratch. 

A value of "1 to 600" for Pre-Logon Tunnel Rename timeout option would keep the tunnel up for the specified time, so that users can authenticate before terminating the pre-logon tunnel.