When users run the GlobalProtect app for Android, the app reports a Required Client Certificate not found error for the first time and failed when users switched between portals configured with different client certificate profiles. The client certificate authentication is successful when users attempt to connect to the app again.

Safari cannot be added to the application-based split tunnel rule on macOS endpoints.

When the split tunnel settings based on the destination domains are configured on the GlobalProtect gateway and either Chrome or the Edge browser is used to navigate to these domains on macOS endpoints running macOS Catalina 10.15.4 or later, the connection reset errors appear for a few seconds before the website launches.

When the split tunnel settings are configured to exclude application traffic such as Microsoft Teams and Skype, some excluded traffic are still forwarded through the tunnel.

For the GUI version of the GlobalProtect app for Linux, SAML authentication with Microsoft Azure does not work on Ubuntu 1804 or greater versions.

Workaround: Refresh the configuration again to trigger the connection.

When users run the GlobalProtect app for Android on their Chromebooks, the app cannot connect to GlobalProtect gateways based on the source IP address of the user because it runs within the Android container on Chrome OS. The Android container uses a network bridge to connect the app to the network, so it is assigned a different IP address from the source IP address of the Chromebook user.

Workaround: Ensure that gateway selection for the Android operating system is not based on the source IP address of the user by leaving both the Region and IP Address fields empty in the config selection criteria for your client settings configuration (NetworkGlobalProtectGateways<gateway-config>AgentClient Settings<client-settings-config>Config Selection Criteria).

When users run the GlobalProtect app for Android on their Chromebooks, the app cannot connect to GlobalProtect portals using IPv6 because it runs within the Android container in Chrome OS, which does not currently support IPv6.

Workaround: Set the IP Address Type for your GlobalProtect portal to IPv4 Only (NetworkGlobalProtectPortals<<portal-config>General).

The GlobalProtect app does not support portal hostnames with non-English characters.

When users establish a GlobalProtect connection for the first time on iPads running iOS 11.1, and they Don’t Allow GlobalProtect to send them notifications, the Settings -> GlobalProtect link on subsequent notification permission reminders does not open.

Workaround: Upgrade your iPad to iOS 11.3 or a later version.

If you remain on iOS 11.1, you can enable GlobalProtect to send you notifications by going to the GlobalProtect notification settings on your iPad (SettingsNotificationsGlobalProtect) and then selecting Allow Notifications.

On macOS endpoints, the GlobalProtect app can’t detect the following Anti-Malware information for the HIP Match log details of the Gatekeeper security feature (MonitorLogsHIP Match<hip-match-log>):