topic Re: Split tunnel and full tunnel in GlobalProtect Discussions

Split tunnel and full tunnel

FarhanKoujalgi — Tue, 24 Aug 2021 15:53:42 GMT

Hey guys can anyone tell me the proper definition of split tunnel and full tunnel in Global protect. within proper life example, please.

Re: Split tunnel and full tunnel

ShaiW — Wed, 25 Aug 2021 11:55:23 GMT

Split tunneling means you route only the desired subnet into the tunnel. For example the office subnet is 192.168.1.0/24 and this is routed inside. The firewall can scan this traffic and you can apply rules as such.

The problem here is all other traffic, like general web browsing, is egressing from the endpoint to the ISP and not through the NGFW.

Simple put the endpoint has 2 connections - 1 for the office and the other for everything else.

Full tunneling means you route EVERYTHING into the NGFW, via security rules and scanning profiles, just like if the endpoint would be inside the corporate network. Security wise this is the best option.This also means increased traffic through the firewall because ALL browsing from GP connected endpoints passes through the firewall.

Hope this helps,

Shai

Re: Split tunnel and full tunnel

Mick_Ball — Sat, 28 Aug 2021 11:26:15 GMT

Exactly as per @ShaiW .

but we have all traffic, office based and internet base tunnelled via GP and only split tunnel local traffic for teams and outlook. Those 2 applications account for approx 80% of user bandwidth so helps to prevent gateway isp links from melting...