topic GlobalProtect Split-Tunnel via cli. in General Topics

GlobalProtect Split-Tunnel via cli.

Mick_Ball — Wed, 01 Apr 2020 10:47:14 GMT

I am trying to add the MS IP's via cli for split-tunnelling.

the documentation states the following...

set network tunnel global-protect-site-to-site <name> client split-tunneling access-route [ <access-route1>

but this is not working on 8.1.9

I can get this far..

set network tunnel global-protect-gateway "gateway-name" but cannot configure the client settings.

any useful docs would be much appreciated.

Re: GlobalProtect Split-Tunnel via cli.

Mick_Ball — Wed, 01 Apr 2020 11:34:02 GMT

This has been resolved by @goran.katava

set global-protect global-protect-gateway GATEWAY-NAME remote-user-tunnel-configs CONFIG-NAME split-tunneling exclude-access-route

Superstar....

Re: GlobalProtect Split-Tunnel via cli.

StephenG — Fri, 11 Dec 2020 20:03:20 GMT

This path does not work when the device is managed by Panorama:

> edit template <NAME> config vsys vsys1 global-protect global-protect-gateway <NAME> remote-user-tunnel-configs <NAME> split-tunneling

The only options after that point are:

exclude-domains Domains need to go out of tunnel
include-domains Domains need to go through tunnel
<Enter> Finish input

However if I do a show at that point, it clearly shows remaining configuration:

...

exclude-access-route [ 1.1.1.1/32 .....]

...

Re: GlobalProtect Split-Tunnel via cli.

StephenG — Fri, 11 Dec 2020 21:11:24 GMT

<edit>

It seems to work if you are using the SET command in cli not edit to select path:

> set template <NAME> config vsys vsys1 global-protect global-protect-gateway <NAME> remote-user-tunnel-configs <NAME> split-tunneling exclude-access-route 1.1.1.1/32