article Troubleshoot Split Tunnel Domain & Applications and Exclude Video Traffic in GlobalProtect Articles

Troubleshoot Split Tunnel Domain & Applications and Exclude Video Traffic

nnaik — Thu, 14 Jan 2021 19:24:08 GMT

Find troubleshooting tips and tricks related to Split Tunnel Domain & Applications and Exclude Video Traffic features.

Re: Troubleshoot Split Tunnel Domain & Applications and Exclude Video Traffic

Retired Member — Fri, 09 Apr 2021 14:09:41 GMT

Recently ringcentral has changed where their directories reside. What was under %appdata% is now under %program files%. I noticed this after a number of users started complaining that ringcentral meetings would not work. I tried adding the following lines below to exclude from tunnel but still facing same issue. This article configuration worked well for the past year until recently after the folder relocation. If I remove exclusions from split tunnel it works great. Any ideas? Do I need a globalprotect license for this to work properly?

%programfiles%\RingCentral\RingCentral.exe
%programfiles(x86)%\RingCentralMeetings\bin\RingCentral_launcher.exe
%programfiles(x86)%\RingCentralMeetings\bin\RingCentralMeetings.exe

Re: Troubleshoot Split Tunnel Domain & Applications and Exclude Video Traffic

rajjair — Tue, 26 Oct 2021 00:33:03 GMT

In the GlobalProtect Log bundle, we don't have gpsplit.log -- just wondering where specifically is this file

"Within the GlobalProtect logs bundle, also review gpsplit.log (the equivalent file on the macOS is PanNExt.log) "

Re: Troubleshoot Split Tunnel Domain & Applications and Exclude Video Traffic

taksato — Fri, 05 Nov 2021 08:01:32 GMT

Hi @rajjair,

Comments in the following page can be helpful for you.

https://live.paloaltonetworks.com/t5/general-topics/globalprotect-working-from-home-prisma-access-and-covid-19/td-p/316122/page/4

######

Thanks for the feedback. Actually gpsplit.log file is available as part of GlobalProtect logs bundle before GlobalProtect client 5.1.4 for macOS. After GlobalProtect client 5.1.4 and later, based on your macOS version you will either see gpsplit.log or PanNext.log [macOS 10.15.4 + GP 5.1.4 onwards]. For windows you can review PanGPS.log file. I will also update the document which you referred with this most current information.

Thanks,

Nehal

######

Re: Troubleshoot Split Tunnel Domain & Applications and Exclude Video Traffic

rjovanovski — Wed, 02 Mar 2022 16:02:55 GMT

Hi @nnaik ,

You sure Domain-based split tunneling is supposed to work for UDP traffic?

Same for the process based.

I did split-tunnel a domain, can see from the logs that an exception is added

""(P12804-T13544)Dump ( 797): 03/02/22 17:31:50:960 SP added an exclude ip 40.76.167.50, port 0, ttl 10 for domain GLOBAL.G.NSSVC.NET, original ttl=10, infinite ttl=no""

However UDP traffic still goes through the tunnel interface.

If I generate some random TCP traffic to the same domain (telnet on random port) I can confirm this TCP traffic goes through the physical interface.

Re: Troubleshoot Split Tunnel Domain & Applications and Exclude Video Traffic

sambhusarath — Wed, 09 Mar 2022 05:41:03 GMT

These added domains, include or exclude, *.ringcentral.com, how does the client machine identifies it as to exit locally or go through the tunnel ?

One issue found is, when added a single domain in a split tunnel, some other domain traffic also starts coming through the tunnel.

Re: Troubleshoot Split Tunnel Domain & Applications and Exclude Video Traffic

rajjair — Sun, 13 Mar 2022 04:04:33 GMT

Thank you for correcting this article in regards to the log files and providing the details very helpful.

However, we seem to be running into an issue with this feature I am just wondering if this has been tested with a recent version of clients and if you guys have a link to try this feature out to confirm this is working as expected to not. In our environment we can see in the pangps.log we can see the video redirect being logged and the session on the firewall also shows the tracker stage of the split-tunnel occurring. However, the video errors out on the browser and the user are not able to play the content, based on the article there is 302 redirect but I don't see that occurring for us on the web trace, this video link is embedded on the site so wondering if this feature works with embedded videos or not.. Any information would help.. I have opened a ticket with support also on this

I also tried to copy the URL and what I noticed on the first try was it fails on the second try it works after I refresh the browser.. but there is no 302 redirect as mentioned in the article above. below is a complete web trace when I have copied the original URL of the video and tried to play it.

Thanks for any info anybody can share...

Raj

Re: Troubleshoot Split Tunnel Domain & Applications and Exclude Video Traffic

asciikeyboard — Mon, 23 Feb 2026 19:53:43 GMT

@nnaik I really appreciate this post. What're the chances we see revisions in 2026 and beyond?