Exclude all Zoom traffic from GlobalProtect VPN

[MarcelST]

We have been trying to exclude all Zoom-related traffic from the GlobalProtect VPN tunnel.

So far we have tried with: "*.zoom.us" exclusion configured directly on the GP gateway as a domain in:

Network --> GlobalProtect --> Gateways --> GW NAME --> Agent --> CLient Settings --> Split tunnel --> Domain and Application

But this seems to not completely do the trick as Zoom use some AWS default domains, not under *.zoom.us.

What approaches will work that does not involve having to manually exclude all the IP ranges as defined here?

https://support.zoom.us/hc/en-us/articles/201362683-Network-Firewall-or-Proxy-Server-Settings-for-Zo...

The Zoom binary path seems to be this one, but I'm not sure PA supports wildcards on the path like this:

C:\Users\*\AppData\Roaming\Zoom\bin\Zoom.exe

[RamiAkermi]

Hi,

This config is working just fine for me.

The config was tested on PAN-OS 0.04 and PAN-OS 9.0.6 and it's working in both cases.

Thanks.

[MarcelST]

What GlobalProtect version are you using?

We did some more tests and we conclude with: Win10 and:

- With Global Protect 5.1 is working fine

- We are not yet sure about GlobalProtect 5.0

- With GlobalProtect 4.1 is not working

[RamiAkermi]

We are using  GlobalProtect client version  5.0.2

Thanks

.

[RamiAkermi]

Hi,

Did you get  the feature exclude  video traffic from vpn tunnel to work?

For me, I'm sure we are using the correct config and we upgraded the GlobalProtect Gateway appliance to PAN-OS 9.0.6 ( the issue was fixed in this release) but still no positive result.

I went through debug and dump logs. Checked the monitoring tab in the PA and I'm still seeing the video streaming traffic go across the tunnel (dailymotion for example).

I opened a case with support but still no answer yet.

Any help will be appreciated.

In case we find a solution with the support team I will share it here

[Sai_Tumuluri]

@RamiAkermi ,

Try configuring both the "Exclude Video Application" option on agent and also domain name under exclude domains. Can you share a screenshot of config

https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-new-features/globalprotect-features/split-tunnel...

[RamiAkermi]

Hi @Sai_Tumuluri 

Please find attached screenshots of the config.

[Sai_Tumuluri]

The simple trick I use is following

Method 1

1. Go to URL logs and filter the traffic of interest
2. The domain the URL logs, is the domain I would recommend to match

Method  2

Wireshark capture

Following is the screenshot I saw for youtube, try adding regex around Youtube

[Jason_Mills]

Hi,

Same issue here GP version 5.1.1-12 

Have added both the Program files and AppData paths to the exclude client apps but udp 8801 is still traversing the VPN.   ALso if i add *.zoom.us to teh exclude domains and open a web browser the site errors as below.    take it out and good to go again. 

Any ideas?

[SuperMario]

Hello Everyone,

I have tested this on 5.0.8 and 5.1.1 and got a successful result.

When tested, I closed the zoom app before connecting to Prisma Access VPN, upon connecting, I opened the zoom client and join a meeting.

Here is an example of the "netstat -anob" output from my windows machine:

10.10.11.3 is my Prisma Access GP IP and 10.55.80.54 is my local (physical interface) IP.

This is how my configuration looks like:

 

I also tried adding the 0.0.0.0 on the include list, and the result was the same.

 

If you are still having issues, please open up a tac case and a member of our team will be more than happy to assist troubleshooting this issue.

[Sai_Tumuluri]

Everyone,

Can you start a zoom meeting with screen sharing and video ON. Add at least 2 people with video

While on meeting run - netstat -aenob

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClQjCAK

Also, for IPs in the traffic logs, enable host lookup, by checking the box at the bottom. Resolve hostname. And share the screenshot again. The above link will help

========================

You can open tac case with the above information or update it here

[MarcelST]

Did some more tests and I can see that all traffic going through the tunnel is:

• Going to port udp/8801
• It belongs to IP network ranges not defined here, as far as I can see:
  • https://support.zoom.us/hc/en-us/articles/201362683-Network-Firewall-or-Proxy-Server-Settings-for-Zo...

                 ( addr.dst in 3.125.86.104 )

                 ( addr.dst in 34.250.58.96 )

                 ( addr.dst in 3.248.169.175 )

                 ( addr.dst in 3.11.161.246 )

                 ( addr.dst in 3.127.185.62 )

                 ( addr.dst in 52.211.174.178 )

The screenshots you were asking for: most of them resolves as amazonaws.com domain, but some other resolves as zoom.us domain too:

[Daniel_Li]

I am trying setting up to split zoom traffic via physical adapter following the link. All traffic goes thru tunnel except zoom.

I am not able to get it work without adding route in excluded access route. We have Gateway subscription license but not portal license.

Just want to confirm if we follow the following link (not mention adding route in excluded tab), Link says it needs Global protect license, Is it portal license or just gateway subscription license

Thank you

https://live.paloaltonetworks.com/t5/Prisma-Access-Articles/GlobalProtect-Implement-Split-Domain-and...

[SuperMario]

Hi Daniel Li,

You need a GlobalProtect subscription for the following feature:

Split tunneling based on destination domain, client process, and video streaming application.

https://docs.paloaltonetworks.com/globalprotect/9-1/globalprotect-admin/globalprotect-overview/about...

Excluding routes does not require an additional license.

[Daniel_Li]

Thank you SuperMario for the reply.

I have installed 90 days trial Global protect gateway. Is that enough ?  It does not work after following the link.  tracert  zoom.us on Window 10 shows going thru tunnel interface, not physical one  ( restart GP service a few time, no access route configured ), I use GP 5.1 for window client. Any suggestion is appreciated

Configuration is used in the link

https://live.paloaltonetworks.com/t5/Prisma-Access-Articles/GlobalProtect-Implement-Split-Domain-and...

[Daniel_Li]

HI Sai

I installed 90 days trial Global protect gateway. Is that enough ?  It does not work after following the link.  tracert  zoom.us on Window 10 shows going thru tunnel interface, not physical one  ( restart GP service a few time, no access route configured ), I use GP 5.1 for window client. if add route in excluded access route. it works but zoom.us IP is changing sometime. Any suggestion is appreciated

Configuration is used in the link

https://live.paloaltonetworks.com/t5/Prisma-Access-Articles/GlobalProtect-Implement-Split-Domain-and...