topic Re: Split Tunnel by Domain Name is not working in GlobalProtect Discussions

Split Tunnel by Domain Name is not working

palomed — Tue, 25 Jan 2022 19:12:18 GMT

I've read a few posts on Split Tunnel by Domain Name. But so far I am only able to get

specific routes to work and not split tunneling by domain name. My test is ipchicken.com

as traffic to it will reveal either my home IP as the source or the corporate public

subnet. I added to INCLDE *.ipchicken.com without specifying ports. After establishing

the GP tunnel my browsing to ipchicken.com shows my home IP. I then tried also

adding ports 443 and 80 to see if that might make a difference. Nope. My system

is still showing my home IP address. Any recommendation on how to get this working?

I figured to hit up the community before opening a case.

Re: Split Tunnel by Domain Name is not working

JoergSchuetter — Tue, 25 Jan 2022 19:55:35 GMT

Hello @palomed

Do you have a GlobalProtect license installed on your VPN gateway? The domain split feature requires that license to be installed.

Re: Split Tunnel by Domain Name is not working

nikoolayy1 — Tue, 25 Jan 2022 21:10:20 GMT

As @JoergSchuetter mentioned the first thing to check is the license and after that you may look also how you have configured your DNS traffic (the Split DNS feature):

How to configure Split DNS - Knowledge Base - Palo Alto Networks

If you have still issues check the PanGPS and PanGPA logs of the globalprotect agent and maybe known issues for your version and the addressed issues for the versions newer than yours:

GlobalProtect App 5.2 Known Issues (paloaltonetworks.com)

Addressed Issues in GlobalProtect App 5.2 (paloaltonetworks.com)

LIVEcommunity - Knowledge sharing: Globalprotect troubleshooting/investgation. Split tunnel,Globalprotect app/agent configuration options and etc. to solve issues - LIVEcommunity - 415420 (paloaltonetworks.com)

Re: Split Tunnel by Domain Name is not working

JHager124 — Fri, 10 Feb 2023 00:18:18 GMT

I am running into the same problem. I am seeing dns and ssl going out of the machine outside of the tunnel but the ssl session never completes. So far known issues doesn't have anything I can tie to the issue. Really hoping not to have to open a TAC case....but its looking like it may need to happen.

-jw