GlobalProtect Auto-Connect Fails when the user tries to connect from a region not allowed by all External Gateways

• Multiple GlobalProtect Gateways are configured with specific source region setting and "Manual (The user can manually select this gateway)" option.
• These options are selected on all External Gateways under Agent config.
• In this scenario, the GlobalProtect Auto-Connect Fails when the user tries to connect from a region not allowed by all External Gateways.
• GlobalProtect app does not retry network discovery and remains in Not Connected state.

• Next-Gen Firewalls
• Supported PAN-OS versions
• GlobalProtect Portal
• GlobalProtect Gateway
• Supported GlobalProtect (GP) App

• Since all External Gateways are configured as manually selectable and there is no suitable Source Region in any of the configured External Gateways, GP does not retry network discovery.
• When GP tunnel is created and underlying network changes, GP does not actively tear down tunnel and tries to restore the current tunnel.
• The GP only re-evaluates priority/region if the tunnel is broken, after which Network Discovery is triggered.

Workaround:

1. Manually trigger refresh connection on the GP App so that region can be refreshed.

Resolution:

1. Make at least one of the External Gateways auto selectable in the GlobalProtect Portal agent config.
2. Enforce the source region under Network > GlobalProtect > Gateways > [gateway-name] > Agent > Client Settings > [config-name] > Config Selection Criteria > Source Address > Region.