Exclude all Zoom traffic from GlobalProtect VPN

[MarcelST]

We have been trying to exclude all Zoom-related traffic from the GlobalProtect VPN tunnel.

So far we have tried with: "*.zoom.us" exclusion configured directly on the GP gateway as a domain in:

Network --> GlobalProtect --> Gateways --> GW NAME --> Agent --> CLient Settings --> Split tunnel --> Domain and Application

But this seems to not completely do the trick as Zoom use some AWS default domains, not under *.zoom.us.

What approaches will work that does not involve having to manually exclude all the IP ranges as defined here?

https://support.zoom.us/hc/en-us/articles/201362683-Network-Firewall-or-Proxy-Server-Settings-for-Zo...

The Zoom binary path seems to be this one, but I'm not sure PA supports wildcards on the path like this:

C:\Users\*\AppData\Roaming\Zoom\bin\Zoom.exe

[MarcelST · Accepted solution]

I finally found the solution. On our case, having the Zoom binary in %AppData% was making the split tunnel not working correctly and Zoom UDP/8801 traffic was sent through the tunnel.

We end up deploying the Zoom package centrally with SCCM to al laptops. Now, with Zoom on C:\Prgoram Files x86 the Zoom exclusion by Process is doing the trick finally.

[Sai_Tumuluri]

thank you for sharing the solution. It really helps

[togase]

Hi I resolved this setting as follows:  We need to add CptHost.exe to offload UDP 8801.

%USERPROFILE%\AppData\Roaming\Zoom\bin\Zoom.exe
%USERPROFILE%\AppData\Roaming\Zoom\bin\CptHost.exe

[EugeneSourman]

We are still having traffic flowing through even after excluding everything suggested in this thread. Seeing 8801/8802 in logs.

Also excluded the below per @togase's suggestion.

%USERPROFILE%\AppData\Roaming\Zoom\bin\Zoom.exe
%USERPROFILE%\AppData\Roaming\Zoom\bin\CptHost.exe

[Daniel_Li]

HI!

For Zoom domain excluded. So far it is not working. Symptom is not stable some client works and then stopped when they go zoom from Browser. It will not display. Case is on engineering team. If anyone got excluded domain working and stable. Please share your comments

Thank you

Daniel

[froche]

Appreciate the information. Using this I was finally able to fully split both tcp 443 and udp 8801 traffic for Windows users. For Mac users I have 443 traffic split but 8801 will not and I can't figure out why. Anyone have any suggestions for Macs?

[Jason_Mills]

The only way we got it to work was to create an address group with all the zoom networks ( about 85 at the last count) and then monitor and add networks as they bring more online and exclude them in the access route tab

[Sai_Tumuluri]

my recommendation is to start a zoom meeting with video and run the netstat command to see the what application is using the port

https://www.tecmint.com/find-out-which-process-listening-on-a-particular-port/

https://helpdeskgeek.com/how-to/use-netstat-to-see-listening-ports-and-pid-in-windows/

[Daniel_Li]

Thank you Sai. It is very useful link. Actually we are not able to get the excluded domain (zooom or www.cisco.com ) working. Ticket was in engineering escalation

Daniel

[BigPalo]

what zoom networks did you use for this objects?

[MarcelST]

https://support.zoom.us/hc/en-us/articles/201362683-Network-Firewall-or-Proxy-Server-Settings-for-Zo...

[BigPalo]

We added all ranges but we are still seeing sessions to these zoom ips reaching the Palo Alto. Did you do any more action?

[EugeneSourman]

When we looked at the network ranges last week, we saw 75 of them (I know @Jason_Mills mentioned 85 to his count but we only saw 75). This week (5/18/20) there are 88 IP ranges. We had to add these to our list:

69.174.108.0/22

140.238.128.0/24

152.67.20.0/24

152.67.118.0/24

152.67.180.0/24

158.101.64.0/24

168.138.16.0/24

168.138.48.0/24

168.138.72.0/24

168.138.244.0/24

193.122.32.0/22

193.123.0.0/19

193.123.40.0/22

193.123.128.0/19

Check to make sure you aren't missing any.

[BigPalo]

We add all IPs in the excluded but if i go to monitor session i can see traffic to these IPs in PA.

Its like GPclient is not taking the routes added properly. 

[Jason_Mills]

It seems to be that there are new ranges coming on faster than they are updating the list of ranges.