If you have recently started working remotely or joined an organization that uses Palo Alto Networks infrastructure, you have probably been asked to install and use GlobalProtect. For many users, it is their first exposure to enterprise-grade VPN software, and the experience can feel different from consumer VPN tools they may have used before. GlobalProtect is more capable, more controlled, and more integrated with your organization’s security infrastructure — which also means there are more things to understand before you just click “connect.”
This guide covers what GlobalProtect actually does, how the connection process works, what permissions and information it collects about your device, how to set it up on different platforms, and what to do when things go wrong. It is written for end users — the remote employees, contractors, and staff members who need to use GlobalProtect as part of their work — not IT administrators.
What GlobalProtect Is and Who Manages It
GlobalProtect is a VPN client developed by Palo Alto Networks, a cybersecurity company headquartered in Santa Clara, California. The software connects your device to your organization’s GlobalProtect gateway — a Palo Alto Networks next-generation firewall that controls access to your company’s internal network resources.
The most important thing to understand upfront: GlobalProtect is managed by your organization’s IT department, not by you. The gateway your GlobalProtect client connects to, the security policies it enforces, the access permissions it grants, and many of its settings are all configured and controlled by your IT administrators. Some settings you might expect to change — such as whether to connect manually or automatically — may be locked by IT policy.
Before anything else, you need the portal address from your IT department. This is a web address (like vpn.yourcompany.com) that GlobalProtect uses to download the correct configuration for your organization. Without this, GlobalProtect cannot be configured. If you have not received it, contact your IT helpdesk.
The current version is GlobalProtect 6.3.3, available for Windows, macOS, iOS, Android, Linux, and Chrome OS from globalprotectdownload.org or through your organization’s distribution channel.
How GlobalProtect Works: The Three-Step Security Check
When you connect to GlobalProtect, it does more than simply establish a VPN tunnel. It performs three distinct functions:
1. Policy Retrieval from the Portal
Your GlobalProtect client first contacts the GlobalProtect Portal (the portal address your IT team provided). The portal authenticates your identity (via username/password, multi-factor authentication, certificates, or a combination) and sends your device the appropriate policy configuration — which gateway to connect to, which security checks to perform, and what network access you are authorized for.
This is different from consumer VPNs where you simply pick a server and connect. GlobalProtect’s policy-driven approach means your connection experience may differ from a colleague’s based on your role, device type, or location.
2. Gateway Connection
Based on the portal’s instructions, GlobalProtect connects to the most appropriate gateway. If your organization has multiple gateways (for example, one in the US and one in Europe), GlobalProtect automatically selects the nearest or best-performing option. You can manually override this in some configurations.
The gateway connection creates an encrypted tunnel — either SSL or IPSec — for all your network traffic. Through this tunnel, you access your organization’s internal resources as if your computer were physically in the office.
3. Host Information Profile (HIP)
This is where GlobalProtect differs most significantly from typical consumer VPNs. GlobalProtect generates a Host Information Profile — a report about the security state of your device — and sends it to the gateway. This HIP report typically includes:
- Operating system version and patch level
- Whether disk encryption (BitLocker on Windows, FileVault on Mac) is active
- Whether antivirus software is installed and up to date
- Firewall status
- Certificate status
Your organization’s IT team configures the gateway to enforce minimum security standards based on the HIP. If your device does not meet the requirements (e.g., your Windows security patches are more than 30 days behind), the gateway may deny the connection or restrict your access until the device is brought into compliance.
Understanding HIP is important because it explains why you might be denied access even though your credentials are correct. It is not a password problem — it is a device security compliance problem. Your IT helpdesk can tell you what the requirements are.
Installing GlobalProtect
Method 1: Download from Your Organization
Most organizations distribute GlobalProtect through their own internal portal. When you sign in to a webpage like vpn.yourcompany.com in your browser, you may see a download link for the GlobalProtect agent. This method ensures you download the version pre-configured for your organization.
Method 2: Download the Standard Installer
If you need to install GlobalProtect manually, the latest version (6.3.3) is available for download at globalprotectdownload.org. After installation, you will manually enter your portal address during the initial configuration step.
Installation on Windows
- Run the downloaded installer (.msi file for Windows).
- Accept the license agreement and follow the wizard.
- The installation creates a GlobalProtect icon in the Windows system tray.
- Click the tray icon to open GlobalProtect.
- Enter the portal address provided by your IT team.
- Click Connect.
- Enter your corporate credentials when prompted (username, password, and potentially a multi-factor authentication code).
Installation on macOS
- Open the downloaded .pkg installer.
- Follow the installation wizard.
- macOS may ask you to approve a system extension (network extension) — go to System Preferences > Security & Privacy and approve it.
- After installation, the GlobalProtect icon appears in the menu bar.
- Click the icon, enter the portal address, and connect.
Installation on iOS
- Search for “GlobalProtect” in the App Store and install the app.
- Open the app and enter the portal address.
- Authenticate with your corporate credentials.
- iOS will prompt you to allow the VPN configuration — tap Allow.
- The VPN icon appears in the status bar when connected.
Installation on Android
- Install GlobalProtect from the Google Play Store.
- Open the app, enter the portal address, and authenticate.
- Grant VPN permissions when prompted.
Understanding Connection Modes
GlobalProtect operates in three modes, and which one your organization uses is determined by IT policy:
Always-On VPN: GlobalProtect connects automatically whenever your device has internet access and stays connected continuously. You cannot disconnect manually (or it reconnects immediately). This mode is common in organizations with strict security requirements — every user’s traffic flows through the corporate gateway at all times, allowing full inspection and policy enforcement.
Remote Access VPN: GlobalProtect connects only when you need access to corporate resources. You connect manually when starting work and may disconnect at the end of the day or when working entirely on local tasks. This is more common in organizations that want VPN connectivity available but do not require it continuously.
Per App VPN (iOS/Android): Only specific applications’ traffic is routed through GlobalProtect. Other apps use your device’s direct internet connection. This mode is common in Bring Your Own Device (BYOD) environments where the organization needs to secure work app traffic without monitoring personal app usage.
Your IT team’s configuration determines which mode you experience. If you are unsure, ask your helpdesk.
What GlobalProtect Can and Cannot See
Remote workers sometimes have concerns about what GlobalProtect monitors on their devices. Here is a factual breakdown:
What GlobalProtect does send to the gateway:
- The Host Information Profile (device security state, as described above)
- Your network traffic destined for corporate resources (this traffic flows through the corporate gateway and is subject to your organization’s security monitoring)
What GlobalProtect does not collect:
- Personal files on your device
- Personal application data
- Screen content or screenshots
- Keystrokes
Important caveat: If Always-On VPN is enabled and all your internet traffic flows through the corporate gateway, your organization can monitor which websites you visit and what network traffic you generate — because that traffic passes through their firewall. This is standard practice in many organizations and typically disclosed in acceptable use policies. Review your organization’s AUP to understand what is monitored.
Common Issues and How to Resolve Them
Cannot Connect — Authentication Failed
- Verify your username and password are correct.
- Check if your password has expired (especially common for first-time connections after account creation).
- If MFA is required, ensure you have completed the second factor correctly.
- Contact IT helpdesk if your credentials have been locked out.
Cannot Connect — HIP Check Failure
If GlobalProtect connects briefly and then disconnects, or shows a message about compliance:
- Check if Windows Update has pending updates — install them and try again.
- Verify antivirus software is active and updated.
- Enable disk encryption if it is disabled.
- Contact IT for the specific compliance requirements your device is missing.
GlobalProtect Connects But Cannot Reach Internal Resources
- Confirm you are on the correct gateway (some organizations have specific gateways for different resource types).
- Try accessing the resource by IP address rather than hostname to rule out internal DNS issues.
- Contact IT with the specific resource you cannot reach — it may be a firewall rule or authorization issue, not a VPN problem.
Split Tunneling Questions
Some organizations configure GlobalProtect with “split tunneling” — only corporate traffic goes through the VPN, and internet browsing goes directly through your local connection. Others route all traffic through the corporate gateway. If your internet seems slower when connected, your organization may be using full tunneling. This is a policy decision — contact IT if it is affecting your work.
GlobalProtect Keeps Disconnecting
- Stable internet is required for a consistent VPN connection. Wi-Fi drops will cause GlobalProtect to disconnect and reconnect.
- Check your computer’s power/sleep settings — computers that go to sleep may interrupt the VPN connection.
- On corporate laptops, ensure the VPN adapter (appears in Network Adapters as a Palo Alto Networks virtual adapter) is not disabled.
Using GlobalProtect Effectively as a Remote Worker
A few practical tips for daily use:
Connect before starting work: For remote access mode, connect to GlobalProtect as your first step when starting the workday, before opening email or other applications. This ensures everything is properly routed from the start.
Report connection problems promptly: VPN connectivity issues affect your ability to work. Contact IT helpdesk early rather than spending hours troubleshooting independently — they have access to gateway logs and can diagnose issues much faster.
Do not try to bypass GlobalProtect: If GlobalProtect is blocking something you need, contact IT. Attempting to bypass corporate security software can violate your employment agreement and creates genuine security risks.
Keep your device updated: GlobalProtect’s HIP checks reward well-maintained devices with full connectivity. Regular Windows Updates and antivirus updates prevent HIP-related connection failures.