exclude-access-route is an invalid ipv4/v6 address

[IanBroadway]

Hi All,,

I'm getting this error, see attached, when trying to add new routes to Global Protect Split Tunnel config.

Only thing I can think of, we're running v9 on Panorama and v8 on the firewalls. do the firewalls not like the format when trying to push to them?

they are due to be upgraded to same v9 end of this week, wait and try again after?

Ian

[JoergSchuetter]

Hello @IanBroadway 

I guess the firewall doesn't know this object yet. We are facing this chicken egg issue as well.

If you don't use this object somewhere within the (security) policy, then it will not be pushed to the firewall node (except you have configured to push all objects, this might result in too many objects on the firewall).

As a dirty workaround, you can add this object in a dummy (but enabled) policy line, e.g. granting access from localhost to the problematic object. 

[IanBroadway]

I guess that makes sense in that you're right, those objects only exist to add to the GP split tunnel config.

They are not used in Policies.

That cant be right though that it needs to be a used object before it can be added to GP split tunnel exclude list. Defeats the point in the first place.

[Remo · Accepted solution]

What you could do also is simply adding the actual network and not an object. This way you won't have this problem with an object that is not available on the firewall.