GlobalProtect app ignores new gateway generated authentication override cookie and keeps using the old portal cookie when the portal is unreachable

• When GP app uses cached portal configuration when the portal is unreachable, the successful gateway generated authentication override cookie will be replaced by the old expired portal cookie when a new gateway authentication event occurs.
• This causes the gateway to consider the expired cookie and trigger the authentication prompt which will generate a new authentication override cookie.
• However, it will be replaced again by the old expired portal cookie at the next gateway authentication event if the app still uses the cached portal configuration.

• GlobalProtect (GP) Portal and Gateway
• GlobalProtect App versions prior to 6.2.8-h4 (6.2.8-c317)
• Authentication Override Cookie configured on GlobalProtect Portal and Gateway(s)

If the portal is unreachable, the GP app will load the old expired portal authentication override cookie from the cached portal configuration.

1. The issue has been fixed under GPC-23646.
2. Upgrading to the fixed version of GP app 6.2.8-h4 (6.2.8-c317) will resolve the issue.