Exclude all Zoom traffic from GlobalProtect VPN

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Exclude all Zoom traffic from GlobalProtect VPN

L3 Networker

We have been trying to exclude all Zoom-related traffic from the GlobalProtect VPN tunnel.

 

So far we have tried with: "*.zoom.us" exclusion configured directly on the GP gateway as a domain in:

Network --> GlobalProtect --> Gateways --> GW NAME --> Agent --> CLient Settings --> Split tunnel --> Domain and Application

 

But this seems to not completely do the trick as Zoom use some AWS default domains, not under *.zoom.us.

 

What approaches will work that does not involve having to manually exclude all the IP ranges as defined here?

https://support.zoom.us/hc/en-us/articles/201362683-Network-Firewall-or-Proxy-Server-Settings-for-Zo...

 

The Zoom binary path seems to be this one, but I'm not sure PA supports wildcards on the path like this:

C:\Users\*\AppData\Roaming\Zoom\bin\Zoom.exe

 

59 REPLIES 59

L3 Networker

I finally found the solution. On our case, having the Zoom binary in %AppData% was making the split tunnel not working correctly and Zoom UDP/8801 traffic was sent through the tunnel.

 

We end up deploying the Zoom package centrally with SCCM to al laptops. Now, with Zoom on C:\Prgoram Files x86 the Zoom exclusion by Process is doing the trick finally.

thank you for sharing the solution. It really helps


~ Sai Srivastava Tumuluri ~

Hi I resolved this setting as follows:  We need to add CptHost.exe to offload UDP 8801.

%USERPROFILE%\AppData\Roaming\Zoom\bin\Zoom.exe
%USERPROFILE%\AppData\Roaming\Zoom\bin\CptHost.exe

 

We are still having traffic flowing through even after excluding everything suggested in this thread. Seeing 8801/8802 in logs.

Screen Shot 2020-05-05 at 12.45.16 PM.pngScreen Shot 2020-05-05 at 12.46.43 PM.png

 

Also excluded the below per @togase's suggestion.

 

%USERPROFILE%\AppData\Roaming\Zoom\bin\Zoom.exe
%USERPROFILE%\AppData\Roaming\Zoom\bin\CptHost.exe

HI!

 

For Zoom domain excluded. So far it is not working. Symptom is not stable some client works and then stopped when they go zoom from Browser. It will not display. Case is on engineering team. If anyone got excluded domain working and stable. Please share your comments

 

Thank you

 

Daniel

Appreciate the information. Using this I was finally able to fully split both tcp 443 and udp 8801 traffic for Windows users. For Mac users I have 443 traffic split but 8801 will not and I can't figure out why. Anyone have any suggestions for Macs?

The only way we got it to work was to create an address group with all the zoom networks ( about 85 at the last count) and then monitor and add networks as they bring more online and exclude them in the access route tab

HDC_0-1588806093819.png

 

my recommendation is to start a zoom meeting with video and run the netstat command to see the what application is using the port

 

https://www.tecmint.com/find-out-which-process-listening-on-a-particular-port/

https://helpdeskgeek.com/how-to/use-netstat-to-see-listening-ports-and-pid-in-windows/


~ Sai Srivastava Tumuluri ~

Thank you Sai. It is very useful link. Actually we are not able to get the excluded domain (zooom or www.cisco.com ) working. Ticket was in engineering escalation

 

Daniel

what zoom networks did you use for this objects?

We added all ranges but we are still seeing sessions to these zoom ips reaching the Palo Alto. Did you do any more action?

When we looked at the network ranges last week, we saw 75 of them (I know @HDC mentioned 85 to his count but we only saw 75). This week (5/18/20) there are 88 IP ranges. We had to add these to our list:

 

69.174.108.0/22

140.238.128.0/24

152.67.20.0/24

152.67.118.0/24

152.67.180.0/24

158.101.64.0/24

168.138.16.0/24

168.138.48.0/24

168.138.72.0/24

168.138.244.0/24

193.122.32.0/22

193.123.0.0/19

193.123.40.0/22

193.123.128.0/19

 

Check to make sure you aren't missing any.

 

 

We add all IPs in the excluded but if i go to monitor session i can see traffic to these IPs in PA.

Its like GPclient is not taking the routes added properly. 

It seems to be that there are new ranges coming on faster than they are updating the list of ranges.

  • 53480 Views
  • 59 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!