topic Re: Global protect excluded networks in General Topics

Global protect excluded networks

fcellini — Fri, 17 Feb 2012 10:35:15 GMT

Hi all,

there is a method on global protect to send all my traffic into the tunnel, but exclude the subnet range of the customer to remain connected with the office network and browse the web protected from office infrastructure, but with the possibility to work on all customer network and not only on the same lan?

Thanks.

Re: Global protect excluded networks

sjamaluddin — Wed, 22 Feb 2012 16:12:01 GMT

Hi,

Do you want to remain connectd to the local LAN and have only the traffic intended for the remote office tunneled? If so, you'd want to configure split tunneling on the PAN FW such that the Global Protect Clients access the remote Office LAN via the tunnel and all other traffic (to the Internet and local LAN) via their own ISP and local connection.

However, you cannot configure this on the Global Prorect Client itself - Access Routes (split tunneling) are configured on the PAN FW.

If your requirement is different from what is explained here, please explain further.

Thanks

Re: Global protect excluded networks

fcellini — Wed, 22 Feb 2012 16:26:31 GMT

Thats not exactly what i said... i want all traffic from my pc when i'm from a customer goes by tunnel to my office, included my internet connection, and exclude from the tunnell only the subnet who i have to the customer.

EX all 0.0.0.0/0 Pa-500 to office...(all traffic internet included)

10.50.0.0 Network customer excluded from tunnel.

So i can reach all that i want inside my customer network without disconnect vpn connection.

The vpn split as i see on PA i can specify the network to tunnel but i can't exclude a specific network, but is a things possible on small router with cisco vpn integrated isn't possible on Paloalto FW?

Re: Global protect excluded networks

bpappas — Thu, 23 Feb 2012 03:00:16 GMT

@fcellini:

Your requirement looks like it is not currently supported by the available GP configuration options. I would suggest talking to your sales team to have them file a feature request for this use case.

As a workaround you could defined all networks in the access routes with the exclusion of the 10.150.0.0/24 subnet. This should work as a short term band-aid for your use case.

-Benjamin