topic Re: Configure Split tunneling by domain in General Topics

Configure Split tunneling by domain

BigPalo — Mon, 07 Jul 2025 12:31:16 GMT

Hi,

I just configured split tunneling by domain using this domain test: *.portal.microsoft.com (port 443)

But i can not see this traffic going into the tunnel. how can i tshooting this?

thanks

Re: Configure Split tunneling by domain

Raido_Rattameister — Wed, 02 Jul 2025 13:27:21 GMT

If you configure split tunneling for a domain then you effectively configure this domain not to be routed into the tunnel but directly towards Internet.

Re: Configure Split tunneling by domain

BigPalo — Mon, 07 Jul 2025 12:30:01 GMT

Hi,

I have configured in GP all my internal networks through the tunnel and the rest by local ISP. I need to add this public domain through the tunnel. I added this config but i can not see anything in PA

Re: Configure Split tunneling by domain

BPry — Fri, 04 Jul 2025 08:05:45 GMT

@BigPalo,

Couple questions:

Do you have a GlobalProtect license so that you can actually utilize this functionality?
Have you verified for sure that the traffic isn't attempting to utilize QUIC? This functionality only works with TCP traffic and if your browser is using QUIC (which is UDP) it won't function properly.
What agent version are you using.

As far as troubleshooting goes you'll want to set your client logging to debug and look in the logs for the domain in question and look for an entry in PanGPS.log that looks like what is denoted below:

(P6668-T26348)Dump (2039): 07/04/25 03:02:58:982 Domain name wxt-general-ingressgateway.acmhwxt-prd-1.prod.infra.webex.com matches exclude wildcard domain

This will tell you whether it's matching your rules or not.

Re: Configure Split tunneling by domain

BigPalo — Mon, 07 Jul 2025 12:30:25 GMT

Working