Configure Split tunneling by domain

[BigPalo]

Hi,

I just configured split tunneling by domain using this domain test: *.portal.microsoft.com (port 443)

But i can not see this traffic going into the tunnel. how can i tshooting this?

thanks

[Raido_Rattameister]

If you configure split tunneling for a domain then you effectively configure this domain not to be routed into the tunnel but directly towards Internet.

[BigPalo]

Hi,

I have configured in GP all my internal networks through the tunnel and the rest by local ISP. I need to add this public domain through the tunnel. I added this config but i can not see anything in PA

[BPry · Accepted solution]

@BigPalo,

Couple questions:

• Do you have a GlobalProtect license so that you can actually utilize this functionality?
• Have you verified for sure that the traffic isn't attempting to utilize QUIC? This functionality only works with TCP traffic and if your browser is using QUIC (which is UDP) it won't function properly.
• What agent version are you using.

As far as troubleshooting goes you'll want to set your client logging to debug and look in the logs for the domain in question and look for an entry in PanGPS.log that looks like what is denoted below:

(P6668-T26348)Dump (2039): 07/04/25 03:02:58:982 Domain name wxt-general-ingressgateway.acmhwxt-prd-1.prod.infra.webex.com matches exclude wildcard domain

This will tell you whether it's matching your rules or not. 

[BigPalo]

Working