Exclude all Zoom traffic from GlobalProtect VPN

[RamiAkermi]

Hi @Sai_Tumuluri 

Please find attached screenshots of the config.

[Sai_Tumuluri]

The simple trick I use is following

Method 1

1. Go to URL logs and filter the traffic of interest
2. The domain the URL logs, is the domain I would recommend to match

Method  2

Wireshark capture

Following is the screenshot I saw for youtube, try adding regex around Youtube

[HDC]

Hi,

Same issue here GP version 5.1.1-12 

Have added both the Program files and AppData paths to the exclude client apps but udp 8801 is still traversing the VPN.   ALso if i add *.zoom.us to teh exclude domains and open a web browser the site errors as below.    take it out and good to go again. 

Any ideas?

[SuperMario]

Hello Everyone,

I have tested this on 5.0.8 and 5.1.1 and got a successful result.

When tested, I closed the zoom app before connecting to Prisma Access VPN, upon connecting, I opened the zoom client and join a meeting.

Here is an example of the "netstat -anob" output from my windows machine:

10.10.11.3 is my Prisma Access GP IP and 10.55.80.54 is my local (physical interface) IP.

This is how my configuration looks like:

 

I also tried adding the 0.0.0.0 on the include list, and the result was the same.

 

If you are still having issues, please open up a tac case and a member of our team will be more than happy to assist troubleshooting this issue.

[Sai_Tumuluri]

Everyone,

Can you start a zoom meeting with screen sharing and video ON. Add at least 2 people with video

While on meeting run - netstat -aenob

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClQjCAK

Also, for IPs in the traffic logs, enable host lookup, by checking the box at the bottom. Resolve hostname. And share the screenshot again. The above link will help

========================

You can open tac case with the above information or update it here

[MarcelST]

Did some more tests and I can see that all traffic going through the tunnel is:

• Going to port udp/8801
• It belongs to IP network ranges not defined here, as far as I can see:
  • https://support.zoom.us/hc/en-us/articles/201362683-Network-Firewall-or-Proxy-Server-Settings-for-Zo...

                 ( addr.dst in 3.125.86.104 )

                 ( addr.dst in 34.250.58.96 )

                 ( addr.dst in 3.248.169.175 )

                 ( addr.dst in 3.11.161.246 )

                 ( addr.dst in 3.127.185.62 )

                 ( addr.dst in 52.211.174.178 )

The screenshots you were asking for: most of them resolves as amazonaws.com domain, but some other resolves as zoom.us domain too:

[Daniel_Li]

I am trying setting up to split zoom traffic via physical adapter following the link. All traffic goes thru tunnel except zoom.

I am not able to get it work without adding route in excluded access route. We have Gateway subscription license but not portal license.

Just want to confirm if we follow the following link (not mention adding route in excluded tab), Link says it needs Global protect license, Is it portal license or just gateway subscription license

Thank you

https://live.paloaltonetworks.com/t5/Prisma-Access-Articles/GlobalProtect-Implement-Split-Domain-and...

[SuperMario]

Hi Daniel Li,

You need a GlobalProtect subscription for the following feature:

Split tunneling based on destination domain, client process, and video streaming application.

https://docs.paloaltonetworks.com/globalprotect/9-1/globalprotect-admin/globalprotect-overview/about...

Excluding routes does not require an additional license.

[Daniel_Li]

Thank you SuperMario for the reply.

I have installed 90 days trial Global protect gateway. Is that enough ?  It does not work after following the link.  tracert  zoom.us on Window 10 shows going thru tunnel interface, not physical one  ( restart GP service a few time, no access route configured ), I use GP 5.1 for window client. Any suggestion is appreciated

Configuration is used in the link

https://live.paloaltonetworks.com/t5/Prisma-Access-Articles/GlobalProtect-Implement-Split-Domain-and...

[Daniel_Li]

HI Sai

I installed 90 days trial Global protect gateway. Is that enough ?  It does not work after following the link.  tracert  zoom.us on Window 10 shows going thru tunnel interface, not physical one  ( restart GP service a few time, no access route configured ), I use GP 5.1 for window client. if add route in excluded access route. it works but zoom.us IP is changing sometime. Any suggestion is appreciated

Configuration is used in the link

https://live.paloaltonetworks.com/t5/Prisma-Access-Articles/GlobalProtect-Implement-Split-Domain-and...