topic Re: Split tunneling based on the domain is not working. in GlobalProtect Discussions

Split tunneling based on the domain is not working.

NavigantNetworkteam — Wed, 22 May 2019 07:59:13 GMT

Split tunneling based on the domain is not working. We need to monitor our user's web traffic while they are on roaming. While users need to connect GlobalProtect and Cisco Any connects simultaneously, some traffic should go via Cisco Any connects and rest of them via GlobalProtect. I tried split tunneling based on the domain but no luck. Is there any solution for this.

PAN-OS - 8.1.7

GlobalProtect- 5.0.2

Re: Split tunneling based on the domain is not working.

khuynh — Tue, 04 Jun 2019 12:52:41 GMT

Hi,

Without mode information, it will be difficult to troubleshooting your problem, maybe a support ticket will be the best thing to do here.

However, just in case of, the split tunneling per domain requires a GP subscription license on the Firewall. May be the cause of your problem.

Re: Split tunneling based on the domain is not working.

Miroslaw_Iwanowski — Wed, 21 Aug 2019 20:15:16 GMT

I have exactly the same problem. Panorama on 9.0.3 level, firewalls on 8.1.8H5. Information on included and excluded networks in split tunneling is visible on Panorama but not on firewalls. There is no relevant issue in commit warnings.

Did you resolved that problem?

Re: Split tunneling based on the domain is not working.

Mick_Ball — Wed, 04 Mar 2020 14:33:45 GMT

@NavigantNetworkteam Hi,

Did you ever resolve this issue.

Re: Split tunneling based on the domain is not working.

Miroslaw_Iwanowski — Wed, 04 Mar 2020 15:26:38 GMT

The only solution is to upgrade firewalls to 9.x version. No other way.

Re: Split tunneling based on the domain is not working.

Mick_Ball — Wed, 04 Mar 2020 16:04:03 GMT

@Miroslaw_Iwanowski

Many thanks for your response.

Re: Split tunneling based on the domain is not working.

goran.katava — Tue, 17 Mar 2020 21:05:02 GMT

I have configured split tunneling on version 9.0.4 in order to offload Office365 from the tunnel. I have added 163 entries in excluded domains. That works fine so far. I don't understand the purpose of included domain list. I even notice that my vpn is not working when I add a list on PA-820. It is working on PA-3200. Which list has a precedence in case of conflicting entries? I can't find this documented on PA.

Re: Split tunneling based on the domain is not working.

Miroslaw_Iwanowski — Tue, 17 Mar 2020 21:07:16 GMT

One comment. For domain based split tunneling you need a global portal license. Do you have it on both devices?

Re: Split tunneling based on the domain is not working.

goran.katava — Wed, 18 Mar 2020 09:26:23 GMT

Sorry, my bad. The firewall type 820 was running 8.1.11. After upgrade to 9.0.5 it is all working good. No Global Protect license is needed for split-tunnel based on domain. I also notice that included domains are required for Office 365 to function properly. That because we use SSO and Microsoft is expecting to see logins coming from registered public addresses. For that I include domains from option 56 as on next Microsoft page:

https://docs.microsoft.com/en-us/office365/enterprise/urls-and-ip-address-ranges

The rest I add to excluded list. In order to configure I use set cli like in next example:

excl:

set global-protect global-protect-gateway GATEWAY_NAME remote-user-tunnel-configs CONFIG_NAME split-tunneling exclude-domains list *.microsoft.com

incl:

set global-protect global-protect-gateway GATEWAY_NAME remote-user-tunnel-configs CONFIG_NAME split-tunneling include-domains list login.microsoft.com

From this lists is visible why included list is needed.

On the portal I use option not to use tunnel for all DNS queries. That way the clients use local ISP for resolving Microsoft addresses, in order to connect to the nearest pod.

Let me know if you need complete list of Office 365. I had to tweak it in order to have less than 200 entries.

Re: Split tunneling based on the domain is not working.

Retired Member — Wed, 18 Mar 2020 16:37:00 GMT

I am having the same issue but we are trying to exclude WebEx and Blackboard Collaborate and I cannot get this to work via domain names...the traffic just comes through the VPN.

Any suggestions?

Re: Split tunneling based on the domain is not working.

Mick_Ball — Thu, 19 Mar 2020 08:33:20 GMT

@goran.katava , Hi

i would like to see your cut down list as may be the way to go but I found this link and it suggests only a few for optimization.

I dont thing 365 will work if we shutdown the VPN tunnel with such a few url's but it does seem to keep the bulk of office traffic local.

https://techcommunity.microsoft.com/t5/office-365-blog/how-to-quickly-optimize-office-365-traffic-for-remote-staff-amp/ba-p/1214571

Re: Split tunneling based on the domain is not working.

rajjair — Wed, 25 Mar 2020 15:25:09 GMT

Hi Goran

Are you able to share you configuration.. we are trying to split the o365 traffic want to ensure we are configuring it correctly. Teams traffic for us is still going through the tunnel..

Did you do any split tunnel using process or all domains

Re: Split tunneling based on the domain is not working.

goran.katava — Wed, 25 Mar 2020 18:03:19 GMT

Hi RJ,

I followed advice from @Mick_Ball, and realized that 'optimized' should be enough for split-tunnel on Global Protect.

Search for category 'optimize' on next :

https://endpoints.office.com/endpoints/worldwide?clientrequestid=b10c5ed1-bad1-445f-b386-b919946339a7

It takes 4 domains and about 20 subnets.

set global-protect global-protect-gateway GATEWAY_NAME remote-user-tunnel-configs test-Office365-offloading split-tunneling exclude-access-route [ 13.107.18.10/31 13.107.6.152/31
13.107.64.0/18 13.107.128.0/22 13.107.136.0/22 23.103.160.0/20 40.96.0.0/13 40.104.0.0/15 40.108.128.0/17 52.96.0.0/14 52.104.0.0/14 52.112.0.0/14 104.146.128.0/17 131.253.33.215/32 132.245.0.0/16 150.171.32.0/22 150.171.40.0/22 191.234.140.0/22 204.79.197.215/32 ]

set global-protect global-protect-gateway GATEWAY_NAME remote-user-tunnel-configs test-Office365-offloading split-tunneling exclude-domains list outlook.office.com
set global-protect global-protect-gateway GATEWAY_NAME remote-user-tunnel-configs test-Office365-offloading split-tunneling exclude-domains list outlook.office365.com
set global-protect global-protect-gateway GATEWAY_NAME remote-user-tunnel-configs test-Office365-offloading split-tunneling exclude-domains list company-name.sharepoint.com
set global-protect global-protect-gateway GATEWAY_NAME remote-user-tunnel-configs test-Office365-offloading split-tunneling exclude-domains list company-name-my.sharepoint.com

Re: Split tunneling based on the domain is not working.

rajjair — Wed, 25 Mar 2020 18:25:04 GMT

Thanks for that.. I am curious have you tried doing split tunnel based on process name

exclude-applications [ "%PROGRAMFILES(X86)%\VMware\VMware Horizon View Client\vmware-view.exe" "%PROGRAMFILES(X86)%\VMware\VMware Horizon View Client\x64\vmware-remotemks.exe" "%PROGRAMFILES%\Microsoft Office\root\Office16\OUTLOOK.EXE" %LOCALAPPDATA%\Microsoft\Teams\current\Teams.exe];

Raj

Re: Split tunneling based on the domain is not working.

Mick_Ball — Wed, 25 Mar 2020 19:32:51 GMT

@rajjair , yes we use %LOCALAPPDATA%\Microsoft\Teams\current\Teams.exe as an exception but some teams traffic is still sent via the tunnel

Re: Split tunneling based on the domain is not working.

rajjair — Thu, 26 Mar 2020 05:32:22 GMT

Hi MickBall

That is what I had and observed also, in the palo traffic logs i could see ms-teams app coming for VPN users. Before I found this forum I had also opened a ticket with support on this issue as wanted a way to confirm traffic for sure is being split or not. What they informed me applications sitting in user context is not supported at this time. I would prefer to use Process ID then IPs as IPs can change and keep config up to date without any automation and checking for changes

---- Here is what the TAC mentioned to me ----

The full path of the application to be included from the tunnel is currently only resolvable in PanGPS context for windows it is system service context.
While for Mac, it is root context in prelogon and user context after user logon.

Currently you have the following path
%USERPROFILE%\AppData\Local\Microsoft\Teams\current\Teams.exe

In order for PanGPS to resolve the path you will need to shift the path to a system service context as opposed to a user context as shown in the example below,
"%ProgramFiles(x86)%\Google\Chrome\Application\chrome.exe"

Other customer requested us to improve this path issue and submitted it as a feature request.
But it has not been implemented yet.
So we suggest to avoid this issue by routing.
Add routes to exclude from the VPN tunnel. These routes are sent through the physical adapter on endpoints rather than through the virtual adapter (the tunnel).

Re: Split tunneling based on the domain is not working.

goran.katava — Thu, 26 Mar 2020 08:09:59 GMT

Hi Rajjair, Mickball,

I don't have Global Protect license, and therefor can't use split tunnel based on application/service.

As I mentioned in previous comment, version 9.0.x seems to support destination domain, even with no license.

We use MS Flow as described in next link, in order to get alerted on any changes of IP ranges or domains.

https://techcommunity.microsoft.com/t5/office-365-networking/use-microsoft-flow-to-receive-an-email-for-changes-to-office-365/m-p/240651

Re: Split tunneling based on the domain is not working.

Mick_Ball — Wed, 01 Apr 2020 10:42:02 GMT

yes static routes are working well... do you know the cli for this...

I have started with "set network tunnel global-protect-gateway" I can add the gateway name but cannot see how to add the client config name.

the documentation sends me here set network tunnel global-protect-site-to-site <name> client split-tunneling access-route [ <access-route1>

but not working on 8.1.9

I am going to create a new post for this.

Re: Split tunneling based on the domain is not working.

goran.katava — Wed, 01 Apr 2020 10:49:02 GMT

Hi,

Here is what I use for O365 (optimized option):

set global-protect global-protect-gateway GATEWAY-NAME remote-user-tunnel-configs CONFIG-NAME split-tunneling exclude-access-route [ 13.107.18.10/31 13.107.6.152/31 13.107.64.0/18 13.107.128.0/22 13.107.136.0/22 23.103.160.0/20 40.96.0.0/13 40.104.0.0/15 40.108.128.0/17 52.96.0.0/14 52.104.0.0/14 52.112.0.0/14 104.146.128.0/17 131.253.33.215/32 132.245.0.0/16 150.171.32.0/22 150.171.40.0/22 191.234.140.0/22 204.79.197.215/32 ]

Re: Split tunneling based on the domain is not working.

rajjair — Wed, 01 Apr 2020 15:10:48 GMT

Hey All

If the application process is located in the user profile directory and would like the ability to use that application for exclude and include then please have your SE vote for this feature request FR#11579

Currently GP client does not support the ability to white-list process id located in the user profile directory. Example application is Microsoft teams

Thanks