topic Re: Global Protect and split-tunnel, strange behavior from Facetime in General Topics

Global Protect and split-tunnel, strange behavior from Facetime

arnljot — Thu, 06 Nov 2014 09:58:08 GMT

We have set up Global Protect with split-tunnel for mobile clients (iPhone, Android). The goal is that ActiveSync is using the tunnel to reach internal servers, and all other traffic can go directly to the internet. GP is set up to distribute routes to two internal networks to the clients through the Access Route parameter in Gateway configuration

One strange thing we observe, is that Facetime is sending traffic destined for some Apple servers over the VPN tunnel despite the fact that the routing table says otherwise. We can observe the Facetime traffic in traffic monitor on the gateway.

Has anyone else observed this?

An other observation: Even when we specify Google DNS servers in the GP client settings, all DNS requests seem to go over the tunnel. It seems thatl GP always send DNS requests over the VPN tunnel, regardless of the routing.

Re: Global Protect and split-tunnel, strange behavior from Facetime

hshah — Thu, 06 Nov 2014 14:12:34 GMT

Hi ArnliJot,

Split tunnelling is not supported with built-in IOS IPsec VPN software. However its supported with Global Protect client.

Please confirm which kind of VPN client are you using? Refer bellow article for more information.

Re: Split tunneling on iOS

Regards,

Hardik Shah

Re: Global Protect and split-tunnel, strange behavior from Facetime

arnljot — Fri, 07 Nov 2014 08:08:29 GMT

Its the Global Protect client for IOS

Re: Global Protect and split-tunnel, strange behavior from Facetime

hshah — Fri, 07 Nov 2014 17:21:48 GMT

Hi Amljot,

With Global Protect Client split tunnelling should work. Could you please share snapshot for access route of Global Protect Configuration.

Regards,

Hardik Shah

Re: Global Protect and split-tunnel, strange behavior from Facetime

arnljot — Tue, 11 Nov 2014 12:20:36 GMT

I don't have access to the device for the moment, but the Access route is to one internal network only, like: 192.168.100.0/24

We see two specific oddities, where one might be by design:

-If primary and secondary DNS for GP clients is set to i.e. 8.8.8.8 and 4.4.4.4, DNS traffic is still sent over the tunnel

-We see Facetime traffic from iPhone over the tunnel

Re: Global Protect and split-tunnel, strange behavior from Facetime

hshah — Tue, 11 Nov 2014 13:08:37 GMT

Hi Arnljot,

In this case split tunneling should work. This appears to be a bug so far. But I dont have any configuration or logs to verify the same.

Regards,

Hardik Shah