Originally Posted by
plunet
Global Protect is the product name of the remote access VPN that is a feature of Palo Alto corporate firewalls.
GP supports many different types of configuration, but if the admins of your wife's workplace have chosen to use a traditional VPN protocol like IPSEC then the great firewall will be blocking that by default. She could open a ticket and ask if they have a different configuration for her device (probably SSL) that might offer a backup option for access from a China WiFi/broadband.
But getting good slug of roaming data for a sensible cost on a HK SIM is very much the easiest option.
The GFW does not block IPsec at all. In fact it is one of the most reliable protocols to get through the GFW because it is so widely used for corporate VPNs. I use IPsec for my personal VPNs running off my personal IP addresses in the USA, and it's been rock solid for more than a decade.
The GFW will instead block IPs regardless of the protocol if they suspect that it is a commercial VPN provider. For a corporate VPN this is usually not a problem.