GlobalProtect on Starlink: common disconnect causes

GlobalProtect generally works on Starlink, because it connects outward to your company’s gateway and Starlink’s CGNAT allows outbound connections. When it drops, the usual causes are a short connection gap long enough to break the tunnel, an IPsec tunnel that can’t hold its path through NAT, timeouts your IT team set on the gateway, or weak home Wi-Fi. You can rule out your own Wi-Fi and other VPNs; the tunnel settings belong to IT, so the most useful thing you can do is hand them precise evidence.

How GlobalProtect connects, in plain terms

GlobalProtect signs you in to your company’s portal, which tells the app which gateways it may use. The app then builds a tunnel to a gateway. Palo Alto’s gateway documentation describes two tunnel types:

• IPsec, when IT enables it (“Enable IPSec” with a crypto profile). This usually performs best for real-time traffic.
• SSL, which Palo Alto says is “used only if the endpoint fails to establish an IPSec tunnel” when both are enabled. IT can also force SSL only by turning IPsec off.

That fallback matters on Starlink. Starlink’s VPN guidance says: Starlink says VPNs over TCP or UDP work; the VPN must support NAT traversal; SSL-based VPNs typically traverse CGNAT best. And it is specific about what CGNAT drops: CGNAT drops VPNs relying on IP protocols 47 (GRE), 50 (ESP), 51 (AH) and 115 (L2TP). Plain IPsec uses protocol 50 (ESP), which CGNAT drops, so on Starlink an IPsec tunnel only works when it is wrapped in UDP (NAT traversal). If that wrapping isn’t possible, GlobalProtect falls back to SSL, which crosses NAT easily but can feel slower on calls.

The four common causes of drops

1. Short outages that break the tunnel

A Starlink connection can have brief gaps (an obstructed moment, a hand-off between satellites). A video call freezes and recovers; a VPN tunnel may decide the gateway is gone and reconnect, which feels like a drop. Check the Starlink app’s outage list at the time of a disconnect: The Starlink app's Statistics page shows speed, uptime, latency, outages and alerts (when on the Starlink router).

2. The IPsec path through CGNAT goes quiet

NAT devices forget a mapping when nothing passes through it for a while. IPsec’s UDP wrapping includes “NAT-keepalive” packets for exactly this reason; the IETF standard says their “sole purpose” is “to keep NAT mappings alive,” with a default of one every 20 seconds when nothing else is sent. If keep-alives are slow or blocked somewhere, the tunnel can stall and the client reconnects, sometimes landing on SSL instead.

3. Timeouts and lifetimes set by IT

Palo Alto lets administrators set “Login Lifetime and Inactivity Logout” for endpoint sessions, and an authentication cookie lifetime (default 24 hours, per Palo Alto’s docs). A drop that happens at the same time of day, or after the same idle period, is often a timer like this, not your connection. Read VPN drops about once an hour for how to spot timer-shaped drops.

4. Home Wi-Fi and competing VPNs

Weak Wi-Fi loses packets and the tunnel reacts. A personal VPN running at the same time as GlobalProtect can fight over routes. Turn off any other VPN and test on a cable.

A worked example: reading your own drop log

Suppose you log a week of drops (these rows are invented to show the method):

Read it in groups. The 17:00 drops with a sign-in prompt and no Starlink outage look like a session lifetime set on the gateway; that goes to IT. The Monday and Tuesday daytime drops line up with Starlink outages; those point to the dish’s view or normal short gaps, and a backup line is the fix if they hurt. The Wednesday morning is Wi-Fi. One week of notes splits a vague “the VPN keeps dropping” into three separate, fixable problems.

Split tunneling and your calls

If your Teams or Zoom calls run through GlobalProtect, every voice packet takes a detour to the company gateway and back, and each tunnel hiccup freezes the call. Microsoft’s own Teams network guidance recommends sending Teams traffic around the VPN (split tunneling), noting that VPNs “are typically not designed or configured to support real-time media.” GlobalProtect supports split tunneling; whether your company uses it is a security decision for IT. It is a fair, specific question to ask, especially on a satellite line.

What you can do today

1. Use a cable for the work laptop, or sit close to the router.
2. Turn off any personal VPN while GlobalProtect is connected.
3. Note the time of each drop and check the Starlink app’s outage list for the same minute.
4. Check which tunnel you are on. The GlobalProtect app’s connection details often show the gateway and tunnel type; if your copy shows SSL when colleagues get IPsec, tell IT.
5. Don’t reboot the dish mid-day to “fix” the VPN; it turns a seconds-long drop into minutes.

What to send IT

A good ticket gets fixed; a vague one gets “restart your router.” Include:

• Dates and times of three or more drops, and how long each lasted.
• Whether the Starlink app showed an outage at those times.
• Your connection type: Starlink Residential, behind CGNAT (router outside address in 100.64.0.0/10; see the 100.64 test), with native IPv6.
• Whether you were on Wi-Fi or a cable, and whether another VPN was running.
• The gateway name and tunnel type shown in the app, if visible.
• A diagnostic report, if your company allows it. On GlobalProtect 6.2 or later for Windows, Palo Alto’s steps are: open the app from the system tray, use the menu on the status panel, choose Report an Issue, and allow the app to run diagnostics and include logs. Your admin has to enable this first.

Common mistakes

• Asking Starlink to fix the VPN. Starlink says it cannot troubleshoot VPN connection issues and the Starlink app may not work properly with a VPN on.
• Assuming a public IP will fix it. Switching to a Public IP may help an incompatible VPN, but Starlink does not guarantee VPN compatibility even then. And A public IPv4 is optional and only available on Local Priority and Global Priority plans.
• Running two VPNs. It almost never ends well.
• Testing only once. VPN drops come and go; three logged incidents beat one anecdote.

When Starlink is the wrong line for this job

If your role requires the VPN all day and your company won’t adjust tunnel settings or allow split tunneling, short Starlink gaps will keep interrupting you. In that case fiber or cable is the better primary line where available, and a cellular backup on a dual-WAN router covers outages. Ask IT before you move if your employer has rules about connection types; our employer-paid setup guide has a checklist.

What we don’t know

We haven’t run GlobalProtect on a Starlink line, and every company configures it differently: gateways, tunnel type, timers and split tunneling are all IT choices. Starlink doesn’t publish its CGNAT timeouts. The Work-Day Reliability Report will count outages long enough to break a VPN session (over 60 seconds) on one logged connection once it has data.

What to do next

• Work through the ladder above on your next drop and log three incidents.
• Read our main VPN guide for how CGNAT affects each VPN type.
• If your company uses Cisco or Fortinet instead, see Cisco Secure Client on Starlink or FortiClient on Starlink.

Research-based: written from vendor documentation, Starlink support pages and standards, not from our own measurements. Starlink rules and prices on this page come from our dated fact file and show the day they were checked; they change, so confirm before you rely on one.Links to Starlink’s plan pages here use the site owner’s own referral link; the owner may get a referral reward and your price is the same. No affiliate links (how we make money). General information, not professional IT, legal or medical advice. Independent · not affiliated with SpaceX or Starlink. Spotted an error? Tell us.