topic Re: SPlit tunneling issue on GlobalProtect in GlobalProtect Discussions

SPlit tunneling issue on GlobalProtect

RomainCouvreur — Wed, 24 Sep 2025 15:01:32 GMT

Hello Community,

We would like to configure split tunneling on Global Protect settings for Webex traffic.

We have the GlobalProtect Gateway License active and enabled.

We have already configured a list of Subnet network excluded in GW >> Agent >> Clients settings >> Split Tunnel >> Access route >> Exclude

However, when Global Protect tunnel is up and check the traffic from the mobile, the Webex traffic pass through the tunnel and it is not excluded.
We have this behavior only for iPhone mobile or Android Mobile.

Indeed, from Windows and Mac no issue as all traffic for Webex go directly to Internet not through the tunnel.

From the PA documentation, I can notice that the configuration proposed is always for Windows and MAC but please could you confirm if it s supported for mobiles as well ?

Any suggestion about the configuration if something is missing ?

Thanks in advance for your assistance.

Best regards.

Re: SPlit tunneling issue on GlobalProtect

reaper — Thu, 25 Sep 2025 14:25:32 GMT

you follow this document?

https://docs.paloaltonetworks.com/globalprotect/10-1/globalprotect-admin/globalprotect-gateways/split-tunnel-traffic-on-globalprotect-gateways/configure-split-dns-for-globalprotect-app-on-ios-endpoints

split tunnel does not work the same on mobile devices

Re: SPlit tunneling issue on GlobalProtect

RomainCouvreur — Fri, 26 Sep 2025 07:18:23 GMT

Hello,

Thank you for your feedback.

Yes, we have seen it but I will double check the correct configuration for IOS.

However, Is it also valid for Android endpoint as we can notice :

What Do I Need?

GlobalProtect endpoints running on iOS
GlobalProtect now extends Split DNS-Include functionality to iOS platforms in addition to Linux, Windows, and macOS. (Android ??)

I assume that Android should work with only access route feature, also please note that there is no issue with MAC and Windows with access route.

Best regards.

Re: SPlit tunneling issue on GlobalProtect

RomainCouvreur — Fri, 26 Sep 2025 08:17:54 GMT

Hi,

furthermore on the KB provided, It s said :

Configure Split DNS for GlobalProtect App on iOS Endpoints

*Split-DNS -Exclude functionality is not supported on iOS platforms

On our case we would like to exclude the traffic from the tunnel.

Also, please can you elaborate more about this sentence :

"For iOS and Android endpoints, IP Access Routes control which traffic is tunneled and Domain rules control which DNS queries are tunneled. If you want both DNS and traffic for the same site to be included or excluded in the VPN tunnel, you must configure separate IP and Domain rules accordingly."

Thanks in advance for your assistance.

Best regards

Re: SPlit tunneling issue on GlobalProtect

reaper — Fri, 26 Sep 2025 11:59:21 GMT

it explicitly states it is not supported, so i'd recommend making a feature request with your local sales team :

this sentence:

means that if you have www.example.com A 40.0.0.1

you need to create an IP based include/exclude AND a domain based include/exclude

Re: SPlit tunneling issue on GlobalProtect

RomainCouvreur — Wed, 01 Oct 2025 11:27:40 GMT

Hello,

Unfortunately, the Webex traffic is still passing through the tunnel for mobiles (Android and IOS) even if we have configured exclude access route and exclude domain.

we have also check below KB to ensure that we have all the exclude domains for Webex :

Exclude Domains From GlobalProtect Tunnel - Knowledge Base - Palo Alto Networks

Any advice?

We are still testing and keep you posted if any improvement.

Best regards.