Global Protect - Split Tunnel

[markk96]

Is it possible with global protect and split tunnel setup to have policies applied for url filtering to the local client so that sites can be blocked in split tunnel mode?

[bat]

Hi markk96

You just need to apply URL filtering to the policy with from-zone as the zone to which the required tunnel interface (SPLIT/FULL) is bound.

Let me know if you have any queries.

Thanks

[markk96]

I am not sure, I have a policy setup from my GP_Zone with any and any to L3-Inside and L3-Outside with the URL policy applied.  If I do not use split tunnel it work, if I remove 0.0.0.0/0 from the client portal config it split tunnels and the policy is not picked up. 

[HULK]

This doc might give you some insight:

Using Global Protect with One gateway and both split - full tunnel

Re: GlobalProtect Local LAN Printing

Thanks

[bat]

markk96

I could not get you, when you remove the 0.0.0.0/0 is the client still able to access the Internet through GP (and PAN firewall) after you remove it ?

Thanks

[markk96]

No those did not answer my question, I have already read them.  I still cannot get url filtering to apply to a non split tunnel rule

[markk96]

If I remove 0.0.0.0/0 and disconnect and reconnect the global connect client the pc goes out its local internet and not the company internet, but it can reach internal resources just fine.  I am required to use split tunnel but still apply url-filtering. Not even sure that is possible.

[bat]

markk96

Do you want to apply url-filering for the internal resources you are accessing through GP? Because we can only use URL filtering if the traffic is going through GP i.e. PAN FW.

[markk96]

No i was hoping the client could use the local internet but still have url policy applied from the pan fw to still control websites.

[bat]

markk96

Unfortunately, it is not possible, for the URL filtering policy to be applied the traffic should go through the PAN FW.