topic Re: DNS traffic outside of GlobalProtect tunnel in GlobalProtect Discussions

DNS traffic outside of GlobalProtect tunnel

MikeHinz — Thu, 31 Oct 2024 08:09:51 GMT

Hello,

We use Global Protect to connect our employees via VPN to our site. We think we have configured it that way, that the complete traffic is tunneled to our site after establishing the Global Portect connection.

Now we see that unencrypted DNS traffic is visible outside the tunnel. The target adress of that DNS traffic is the IP of our Global Protect gateway (where also the DNS proxy resides).

Why is this traffic not encrypted an transported via the Global Protect connection and do you have any suggestion which options could be the reason for that behaviour?

Re: DNS traffic outside of GlobalProtect tunnel

Claw4609 — Tue, 16 Dec 2025 13:39:57 GMT

Hello,

What does your split tunnel configuration look like? Is it just include 0.0.0.0/0? Under the app configuration of the portal there is also a flag for "Split-Tunnel-Option" what do you have selected for that?

Re: DNS traffic outside of GlobalProtect tunnel

BPry — Fri, 01 Nov 2024 20:44:25 GMT

@MikeHinz,

You would expect to see some limited DNS traffic happen outside of the tunnel for things like internal host detection. I'd look at what is actually being sent outside of the tunnel to validate, but you're likely seeing that traffic and it's nothing to worry about.

Re: DNS traffic outside of GlobalProtect tunnel

arusharma — Sat, 02 Nov 2024 05:40:40 GMT

Check these settings on the App: https://docs.paloaltonetworks.com/globalprotect/5-2/globalprotect-app-new-features/new-features-released-in-gp-app/split-dns#:~:text=With%20the%20Split%2DTunnel%20Option,in%20addition%20to%20network%20traffic.

Split tunnel Options and Resolve all FQDNs. If its still leaking out of Physical interface try different GP version.