topic Re: Adding Address object to GlobalProtect split tunnel access route list in General Topics

Adding Address object to GlobalProtect split tunnel access route list

UXPSystems — Fri, 13 Apr 2018 19:18:25 GMT

Hi. In the Palo Alto firewall, I've created a new Address object with the type set to FQDN and with a valid DNS record. Saved and committed the change. Then I try to add this newly created address object to the access route list in the GlobalProtect's split tunnel list (we using split tunnel for the VPN connection). However, I am not seeing the new address object that I've created showing in the access route list. It looks the address object with the type set to FQDN do not supported as an entry in the access route. Can someone please confirm if this is true?

Thank you.

Re: Adding Address object to GlobalProtect split tunnel access route list

BPry — Fri, 13 Apr 2018 19:58:00 GMT

@UXPSystems,

It actually let you include an FQDN object in the Access Route configuration.... It isn't supposed to even allow you to do that. FQDN address objects are not supported within the Access Route configuration within the Agent settings, not sure why it even let you include one.

Re: Adding Address object to GlobalProtect split tunnel access route list

Remo — Fri, 13 Apr 2018 20:00:27 GMT

Hi @UXPSystems

No, what you are trying to configure is not possible. With PAN-OS 8.1 and GlobalProtect 4.1 you will have a lot more options about split tunneling but still not exactly this what you are asking in this topic.

More informations about the new features you cand find here: https://www.paloaltonetworks.com/documentation/41/globalprotect/globalprotect-app-new-features/new-features-released-in-gp-agent-4_1/split-tunnel-for-public-applications.html

Edit: @BPry and once again I was a few seconds too late

Re: Adding Address object to GlobalProtect split tunnel access route list

UXPSystems — Fri, 13 Apr 2018 20:08:00 GMT

Great. Thank you all for the input.

It looks like PANOS 8.1 and GlobalProtect 4.1 might provide a solution for me.

Basically I can set the whole SaaS domain to pass through the VPN tunnel; but is not do-able on my PA right now (PA software version is still at 7.1.x).

Re: Adding Address object to GlobalProtect split tunnel access route list

BPry — Fri, 13 Apr 2018 20:29:02 GMT

@UXPSystems,

Just as a friendly FYI PAN-OS 8.1 includes a lot of helpful features that people are looking for, but is not currently recommended for production deployments. Please don't install it on your production firewall and not expect to run into issues.....please!

Re: Adding Address object to GlobalProtect split tunnel access route list

Remo — Fri, 13 Apr 2018 20:24:14 GMT

... and in case you haven't already a GlobalProtect subscription ... you will need one for this new split tunneling feature

Re: Adding Address object to GlobalProtect split tunnel access route list

BPry — Fri, 13 Apr 2018 20:27:54 GMT

@Remo,

See I always said that Palo didn't give GlobalProtect enough love, and that AnyConnect was superior in UI and featureset. Now that it's finally getting on par with other vendors they start hiding all the good stuff behind this subscription. It's like it costs money to make a good product or something 😉