## TL;DR
Confirm the user can reach the portal first (portal issues look like gateway issues), then check the gateway address resolves and is reachable, and verify the client certificate is valid. Most "gateway not responding" cases are DNS, a dead gateway, or an expired machine certificate.

## The error
```text
Gateway not responding. Please check your network connection and try again.
```

## Steps
1. Ask the user to open the portal URL in a browser. Expected: portal loads. If the portal also fails, the problem is network or DNS, not the gateway.
2. Check DNS: can the laptop resolve the gateway hostname? Expected: resolves to the right IP. Try the IP directly in the client as a test.
3. Verify the gateway is actually up: check the firewall dashboard or ask the network team. Expected: gateway service running. A failed-over or down gateway produces exactly this message.
4. Check the machine certificate: on Windows, certlm.msc > Personal > Certificates; look for the device cert expiry. Expected: valid and unexpired. Expired certs fail silently at this stage.
5. Collect PanGPA/PanGPS logs (GlobalProtect > Settings > Troubleshooting > Collect Logs) before escalating. Expected: log bundle ready. The network team needs these, not a screenshot.

## When to use
- GlobalProtect cannot reach the gateway
- Portal works but gateway does not

## When not to use
- Login fails after connecting (authentication issue)
- Connected but no traffic flows (tunnel/routing issue)

## Compatibility
- Palo Alto GlobalProtect 5.x/6.x; PAN-OS gateways

## Variants
### Works on some networks but not others
The user's network blocks the VPN ports or protocol. Test on a phone hotspot to isolate.
### "Portal not responding" instead
Same checklist but aimed at the portal address; portal and gateway are separate services.

## Why it happens
The client must resolve, reach, and authenticate to the gateway in sequence. The error message does not say which step failed, so the checklist walks the chain in order.

## Edge cases
- IPv6-only client networks: ensure the gateway is reachable over the client's IP version.
- Captive portals (hotel/airport): the client cannot complete auth until the portal is dismissed in a browser.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_2FFA5MopJA29XZ7DYAxf6Q