Global Protect and split-tunnel, strange behavior from Facetime

[arnljot]

We have set up Global Protect with split-tunnel for mobile clients (iPhone, Android).  The goal is that ActiveSync is using the tunnel to reach internal servers, and all other traffic can go directly to the internet.  GP is set up to distribute routes to two internal networks to the clients through the Access Route parameter in Gateway configuration

One strange thing we observe, is that Facetime is sending traffic destined for some Apple servers over the VPN tunnel despite the fact that the routing table says otherwise.  We can observe the Facetime traffic in traffic monitor on the gateway.

Has anyone else observed this?

An other observation:  Even when we specify Google DNS servers in the GP client settings, all DNS requests seem to go over the tunnel.  It seems thatl GP always send DNS requests over the VPN tunnel, regardless of the routing.

[hshah]

Hi ArnliJot,

Split tunnelling is not supported with built-in IOS IPsec VPN software. However its supported with Global Protect client.

Please confirm which kind of VPN client are you using? Refer bellow article for more information.

Re: Split tunneling on iOS

Regards,

Hardik Shah

[arnljot]

Its the Global Protect client for IOS

[hshah]

Hi Amljot,

With Global Protect Client split tunnelling should work. Could you please share snapshot for access route of Global Protect Configuration.

Regards,

Hardik Shah

[arnljot]

I don't have access to the device for the moment, but the Access route is to one internal network only, like:  192.168.100.0/24

We see two specific oddities, where one might be by design:

-If primary and secondary DNS for GP clients is set to i.e. 8.8.8.8 and 4.4.4.4, DNS traffic is still sent over the tunnel

-We see Facetime traffic from iPhone over the tunnel

[hshah]

Hi Arnljot,

In this case split tunneling should work. This appears to be a bug so far. But I dont have any configuration or logs to verify the same.

Regards,

Hardik Shah