topic Re: traffic not following the route in GlobalProtect Discussions

traffic not following the route

JoergSchuetter — Fri, 05 Mar 2021 14:27:57 GMT

Hello

We have set split tunnel for our Win10 clients, GP is version 5.1.6 and 5.2.5. PAN-OS is 9.1.7.

- default route to firewall

- bypass tunnel for some network ranges (e.g. MS-Teams)

- bypass tunnel for some URLs (e.g. MS-Teams)

- enable DNS-Split

For a small fractions of the users I see the MS-Teams traffic sent back to the firewall (expected was it is bypassing the tunnel).

The routing table on the client looks correct. Based on the routes the traffic should never be sent via the tunnel.

We tried to remedy a potential issue with the network interface with "netsh int ip reset" as administrator, same result.

Any idea what could cause such a strange behavior?

Re: traffic not following the route

Pawel_G — Fri, 05 Mar 2021 16:57:07 GMT

Hello,

I would recommend to you to take logs from the Global Protect Client at the time when user is trying to connect to Teams.

I would also collect logs from FW from user IP to see what is destination of Teams Server that user is trying to connect. Microsoft is adding IP ranges all the time for different servers around the world. How many Agents Portals, Gateways did you create?

Re: traffic not following the route

JoergSchuetter — Sat, 06 Mar 2021 19:21:38 GMT

Hello @Pawel_G

Unfortunately there is nothing in the logs which raises my attention.

The traffic seen on the firewal is sent to an IP address which is covered by split tunnel.

Re: traffic not following the route

Pawel_G — Mon, 08 Mar 2021 04:59:47 GMT

Hello Joerg,

I would also check your User ID Agent for logs. Sometimes when User ID loose connection to Agent, GP will not pickup Group that you specify.

Also I would collect packet captures.

Re: traffic not following the route

reaper — Mon, 08 Mar 2021 06:43:27 GMT

@Pawel_G group mapping is not controlled through the User-ID agent, so losing connection can't impact group mapping

@JoergSchuetter have you tried reinstalling+upgrading to 5.1.8 the GP agent on one of the affected devices? I've seen something similar both with a bug in the GP agent, and an install that somehow failed to properly bind the gp virtual interface