GlobalProtect Cloud Services Route Precedence

[LCMember2050]

We have had overlapping subnet scenarios where someone is connecting using GlobalProtect Cloud Services from a subnet that overlaps our internal subnet and, as they have a more specific route, access to internal resources is failing as the taffic is being routed via the local router instead of over the VPN due to the more specific route. Due to the size of our internal network, adding more specific routes for all of our subnets isn't really an option and this could be undone anyway with a more specific route.

Does anyone know a way to force all internal traffic down the VPN instead of following more specific routes?

NOTE: GlobalProtect Cloud Service has changed to Prisma Access.

[MickBall]

Hmm.. no, but do they need local routing, seems a bit odd if your route takes precedence, or is it all the other routes that are local...

never had this issue as we do not allow split tunneling...

[MickBall]

well i say "No" but watch this space...

[LCMember2050]

We mostly see the issue when users are connecting from hotel networks so have no control on their routes. We can manually remove the local route to get the traffic down the tunnel but not the easiest solution for users.

[MickBall]

if you remove all routes from the gateway config on the palo alto it will auto force all traffic down the tunnel by default.