Adding Address object to GlobalProtect split tunnel access route list

[UXPSystems]

Hi.  In the Palo Alto firewall, I've created a new Address object with the type set to FQDN and with a valid DNS record.   Saved and committed the change.  Then I try to add this newly created address object to the access route list in the GlobalProtect's split tunnel list (we using split tunnel for the VPN connection).  However, I am not seeing the new address object that I've created showing in the access route list.  It looks the address object with the type set to FQDN do not supported as an entry in the access route.  Can someone please confirm if this is true?  

Thank you.

[BPry]

@UXPSystems,

It actually let you include an FQDN object in the Access Route configuration.... It isn't supposed to even allow you to do that. FQDN address objects are not supported within the Access Route configuration within the Agent settings, not sure why it even let you include one. 

[Remo · Accepted solution]

Hi @UXPSystems

No, what you are trying to configure is not possible. With PAN-OS 8.1 and GlobalProtect 4.1 you will have a lot more options about split tunneling but still not exactly this what you are asking in this topic.

More informations about the new features you cand find here: https://www.paloaltonetworks.com/documentation/41/globalprotect/globalprotect-app-new-features/new-f...

Edit: @BPry and once again I was a few seconds too late

[UXPSystems]

Great.  Thank you all for the input.

It looks like PANOS 8.1 and GlobalProtect 4.1 might provide a solution for me. 

Basically I can set the whole SaaS domain to pass through the VPN tunnel; but is not do-able on my PA right now (PA software version is still at 7.1.x).

[BPry]

@UXPSystems,

Just as a friendly FYI PAN-OS 8.1 includes a lot of helpful features that people are looking for, but is not currently recommended for production deployments. Please don't install it on your production firewall and not expect to run into issues.....please! 

[Remo]

... and in case you haven't already a GlobalProtect subscription ... you will need one for this new split tunneling feature

[BPry]

@Remo,

See I always said that Palo didn't give GlobalProtect enough love, and that AnyConnect was superior in UI and featureset. Now that it's finally getting on par with other vendors they start hiding all the good stuff behind this subscription. It's like it costs money to make a good product or something 😉