topic exclude-access-route is an invalid ipv4/v6 address in General Topics

exclude-access-route is an invalid ipv4/v6 address

IanBroadway — Wed, 15 Jul 2020 11:56:09 GMT

Hi All,,

I'm getting this error, see attached, when trying to add new routes to Global Protect Split Tunnel config.

Only thing I can think of, we're running v9 on Panorama and v8 on the firewalls. do the firewalls not like the format when trying to push to them?

they are due to be upgraded to same v9 end of this week, wait and try again after?

Ian

Re: exclude-access-route is an invalid ipv4/v6 address

JoergSchuetter — Wed, 15 Jul 2020 14:14:37 GMT

Hello @IanBroadway

I guess the firewall doesn't know this object yet. We are facing this chicken egg issue as well.

If you don't use this object somewhere within the (security) policy, then it will not be pushed to the firewall node (except you have configured to push all objects, this might result in too many objects on the firewall).

As a dirty workaround, you can add this object in a dummy (but enabled) policy line, e.g. granting access from localhost to the problematic object.

Re: exclude-access-route is an invalid ipv4/v6 address

IanBroadway — Wed, 15 Jul 2020 14:20:30 GMT

I guess that makes sense in that you're right, those objects only exist to add to the GP split tunnel config.

They are not used in Policies.

That cant be right though that it needs to be a used object before it can be added to GP split tunnel exclude list. Defeats the point in the first place.

Re: exclude-access-route is an invalid ipv4/v6 address

Remo — Sun, 19 Jul 2020 22:58:26 GMT

What you could do also is simply adding the actual network and not an object. This way you won't have this problem with an object that is not available on the firewall.