topic Re: Globalprotect end users are receiving default route (0.0.0.0) but it is not configured to do tha in GlobalProtect Discussions

Globalprotect end users are receiving default route (0.0.0.0) but it is not configured to do that

axelrafaeltadoy — Fri, 20 Nov 2020 17:58:57 GMT

Hello masters,

I need your help on how to troubleshoot an issue related to global protect.

On our Access routes, no 0.0.0.0 are configured.

We wanted to let users use their local gateway for any traffic destined to the internet.

But they are receiving the 0.0.0.0 in their RoutePrint resulting to traversing their any traffic to the VPN.

This is clogging our network.

I already engaged 3 TAC on this but could not find the issue.

Details:

Software Version8.1.9-h4

GlobalProtect Agent4.1.10

RoutePrint:

Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.0.1 192.168.0.199 35
0.0.0.0 0.0.0.0 On-link 10.0.0.201 50

Re: Globalprotect end users are receiving default route (0.0.0.0) but it is not configured to do tha

staustin — Sat, 21 Nov 2020 03:55:54 GMT

Please post a picture or details of your split tunnel configuration on your gateway.

Re: Globalprotect end users are receiving default route (0.0.0.0) but it is not configured to do tha

axelrafaeltadoy — Tue, 01 Dec 2020 11:23:32 GMT

Re: Globalprotect end users are receiving default route (0.0.0.0) but it is not configured to do tha

axelrafaeltadoy — Tue, 01 Dec 2020 11:25:11 GMT

Please see below access route

Re: Globalprotect end users are receiving default route (0.0.0.0) but it is not configured to do tha

Mick_Ball — Tue, 01 Dec 2020 17:45:01 GMT

default routes 0.0.0/0 always apply whether using split tunnel or not.

your more specific routes /32 /24/23 etc will take precedence over /0

is there any more information in your route print or have you just left it out.....

Re: Globalprotect end users are receiving default route (0.0.0.0) but it is not configured to do tha

laurence64 — Wed, 02 Dec 2020 13:03:49 GMT

We have had a similar issue, the workaround for us was to exclude the default route from the split tunnel.

Re: Globalprotect end users are receiving default route (0.0.0.0) but it is not configured to do tha

Mick_Ball — Wed, 02 Dec 2020 14:24:28 GMT

Hmmm there must be something odd with your settings if thats the case...

I have a test gateway that only includes 10.0.0.0/8

route print below...

so any unknown traffic such as 8.8.8.8 has 2 default routes but the local interface has a lower metric (35) so no traffic goes down the tunnel unless its within 10.0.0.0/8.

Perhaps your metric is the other way round for some odd reason, i would only think this would happen if you had just exclude routes in your settings.

Re: Globalprotect end users are receiving default route (0.0.0.0) but it is not configured to do tha

axelrafaeltadoy — Tue, 15 Dec 2020 20:52:29 GMT

We have done this but still the 0.0.0.0/0 is still there in the route print

Re: Globalprotect end users are receiving default route (0.0.0.0) but it is not configured to do tha

laurence64 — Wed, 16 Dec 2020 08:54:44 GMT

I have to agree with @Mick_Ball the 0.0.0.0/0 route will still be in the routing table but the host will see this as a backup route, the 0.0.0.0/0 route that is via your home network gateway will be used as its metric is takes precedence over the one through the Global protect tunnel, if you were, for instance, to configure the Global Protect to tunnel all traffic then the metrics would be the other way around.

As it is your include routes are tunnelled and the host will only use the GP default route should the 192 gateway become unavailable, however that would also cut off your connectivity so you would have bigger issues!

My logic behind excluding the 0.0.0.0/0 route was simply that by actively excluding it, it may not find it's way into the routing table at all.

Re: Globalprotect end users are receiving default route (0.0.0.0) but it is not configured to do that

szaidi110 — Thu, 10 Aug 2023 15:47:32 GMT

was there a solution to this problem? apparently, I have run into the same problem where GP installs a default route albeit with a higher metric in the route table. What's weird is this behavior is seen on Windows and a Mac system but not on an Ubuntu OS.

Re: Globalprotect end users are receiving default route (0.0.0.0) but it is not configured to do that

kiwi — Wed, 16 Aug 2023 07:34:27 GMT

Hi @szaidi110 ,

Have you tried excluding the route as mentioned in earlier replies ?

Please also clarify which GP version you're experiencing this with.

Kind regards,

-Kim.

Re: Globalprotect end users are receiving default route (0.0.0.0) but it is not configured to do that

szaidi110 — Wed, 16 Aug 2023 12:41:20 GMT

Hi @kiwi

Excluding the route doesn't work. Evidently, if you have any values configured under the domain and application option (which we did), PAN GP will install a default route for it even if you've excluded it from the access routes. No other way around it.

Re: Globalprotect end users are receiving default route (0.0.0.0) but it is not configured to do that

BigPalo — Fri, 20 Jun 2025 07:18:11 GMT

Is there any way to avoid/deleted default route when you add any domain in split tunneling?

Re: Globalprotect end users are receiving default route (0.0.0.0) but it is not configured to do that

PDossett — Tue, 08 Jul 2025 13:02:37 GMT

I worked around it by adding:

0.0.0.0/1

128.0.0.0/1

as exclude routes.