When GlobalProtect is configured in Proxy-only or Tunnel + Proxy mode, disconnecting the agent may fail to clear the System Proxy PAC (Proxy Auto-Configuration) settings if the System Preferences (or System Settings) window is open at the time of disconnection. This results in the system attempting to use an invalid or unreachable PAC file while GlobalProtect Proxy is disabled, leading to a loss of internet connectivity.

Workaround: If you encounter this state, you must manually remove the stale configuration entries and restart the system.

Manual Remediation Steps:

When your GlobalProtect client disconnects from Prisma Access, it does not restore the previously configured proxy PAC file Script address on your client machine. This occurs when Prisma Access pushes a different PAC file location during the connection, and upon disconnect, GlobalProtect does not revert to the original Script address.