topic Re: GlobalProtect - failed to allow *.google.com through the VPN in General Topics

GlobalProtect - failed to allow *.google.com through the VPN

DongQu — Fri, 24 Dec 2021 13:27:45 GMT

hello everyone

Merry Xmas,

Our SSLVPN has tunnel split enabled, but I want to allow all my traffic or the *.google.com through the VPN, so I tried:

1. added 0.0.0.0/0 to here, does not work.

2. added *.google.com to here, does not work.

Can please someone let me know do I still miss something?

Thanks

Re: GlobalProtect - failed to allow *.google.com through the VPN

MP18 — Fri, 24 Dec 2021 16:07:14 GMT

@DongQu

You need to add two entries

*.google.com----------------this for any domain like test.google.com

google.com--------------------this is for google.com

Regards

Re: GlobalProtect - failed to allow *.google.com through the VPN

DongQu — Sun, 26 Dec 2021 12:02:47 GMT

thanks for the reply but that does not work, I still cannot access to any google sites...

Re: GlobalProtect - failed to allow *.google.com through the VPN

MP18 — Sun, 26 Dec 2021 18:47:49 GMT

@DongQu

Also check under agent application how dns is configured split to not?

when you do nslookup for google which dns it uses to resolve ?

dns provided by the tunnel or your local internet dns?

Regards

Re: GlobalProtect - failed to allow *.google.com through the VPN

DongQu — Mon, 27 Dec 2021 02:28:04 GMT

Hello

It was using the DNS provide by the tunnel.

Re: GlobalProtect - failed to allow *.google.com through the VPN

TomYoung — Tue, 28 Dec 2021 17:10:40 GMT

Hi @DongQu ,

Split-tunneling by domain requires a GP license -> https://docs.paloaltonetworks.com/globalprotect/9-1/globalprotect-admin/globalprotect-overview/about-globalprotect-licenses.html. Do you have a GP subscription for your firewalls?

Thanks,

Tom

Re: GlobalProtect - failed to allow *.google.com through the VPN

DongQu — Wed, 29 Dec 2021 03:22:51 GMT

yes, we have the license.

Re: GlobalProtect - failed to allow *.google.com through the VPN

DongQu — Wed, 29 Dec 2021 03:25:06 GMT

I forgot to mention that the client is an Android Phone, the TAC told me that the "domain" based split does not support the mobile devices.

I tested the settings on a laptop which was working well.

Closing this case.

Re: GlobalProtect - failed to allow *.google.com through the VPN

MP18 — Wed, 29 Dec 2021 03:31:09 GMT

@DongQu

Thanks for updating us with very useful info.

Regards