topic Re: Global Protect - Split Tunnel in General Topics

Global Protect - Split Tunnel

markk96 — Fri, 05 Sep 2014 23:53:07 GMT

Is it possible with global protect and split tunnel setup to have policies applied for url filtering to the local client so that sites can be blocked in split tunnel mode?

Re: Global Protect - Split Tunnel

bat — Fri, 05 Sep 2014 23:56:14 GMT

Hi markk96

You just need to apply URL filtering to the policy with from-zone as the zone to which the required tunnel interface (SPLIT/FULL) is bound.

Let me know if you have any queries.

Thanks

Re: Global Protect - Split Tunnel

markk96 — Sat, 06 Sep 2014 00:14:30 GMT

I am not sure, I have a policy setup from my GP_Zone with any and any to L3-Inside and L3-Outside with the URL policy applied. If I do not use split tunnel it work, if I remove 0.0.0.0/0 from the client portal config it split tunnels and the policy is not picked up.

Re: Global Protect - Split Tunnel

HULK — Sat, 06 Sep 2014 00:22:38 GMT

This doc might give you some insight:

Using Global Protect with One gateway and both split - full tunnel

Re: GlobalProtect Local LAN Printing

Thanks

Re: Global Protect - Split Tunnel

bat — Sat, 06 Sep 2014 00:28:34 GMT

markk96

I could not get you, when you remove the 0.0.0.0/0 is the client still able to access the Internet through GP (and PAN firewall) after you remove it ?

Thanks

Re: Global Protect - Split Tunnel

markk96 — Sat, 06 Sep 2014 00:29:25 GMT

No those did not answer my question, I have already read them. I still cannot get url filtering to apply to a non split tunnel rule

Re: Global Protect - Split Tunnel

markk96 — Sat, 06 Sep 2014 00:31:03 GMT

If I remove 0.0.0.0/0 and disconnect and reconnect the global connect client the pc goes out its local internet and not the company internet, but it can reach internal resources just fine. I am required to use split tunnel but still apply url-filtering. Not even sure that is possible.

Re: Global Protect - Split Tunnel

bat — Sat, 06 Sep 2014 00:42:28 GMT

markk96

Do you want to apply url-filering for the internal resources you are accessing through GP? Because we can only use URL filtering if the traffic is going through GP i.e. PAN FW.

Re: Global Protect - Split Tunnel

markk96 — Sat, 06 Sep 2014 00:45:07 GMT

No i was hoping the client could use the local internet but still have url policy applied from the pan fw to still control websites.

Re: Global Protect - Split Tunnel

bat — Sat, 06 Sep 2014 00:46:34 GMT

markk96

Unfortunately, it is not possible, for the URL filtering policy to be applied the traffic should go through the PAN FW.