GlobalProtect - failed to allow *.google.com through the VPN

[DongQu]

hello everyone

Merry Xmas,

Our SSLVPN has tunnel split enabled, but I want to allow all my traffic or the *.google.com through the VPN, so I tried:

1. added 0.0.0.0/0 to here, does not work.

2. added *.google.com to here, does not work.

Can please someone let me know do I still miss something?

Thanks

[MP18]

@DongQu 

You need to add two entries

*.google.com----------------this for any domain like test.google.com

google.com--------------------this is for google.com

Regards

[DongQu]

thanks for the reply but that does not work, I still cannot access to any google sites...

[MP18]

@DongQu 

Also check under agent application how dns is configured split to not?

when you do nslookup for google which dns it uses to resolve ?

dns provided by the tunnel or your local internet dns?

Regards

[DongQu]

Hello

It was using the DNS provide by the tunnel.

[TomYoung]

Hi @DongQu ,

Split-tunneling by domain requires a GP license -> https://docs.paloaltonetworks.com/globalprotect/9-1/globalprotect-admin/globalprotect-overview/about....  Do you have a GP subscription for your firewalls?

Thanks,

Tom

[DongQu]

yes, we have the license.

[DongQu · Accepted solution]

I forgot to mention that the client is an Android Phone, the TAC told me that the "domain" based split does not support the mobile devices.

I tested the settings on a laptop which was working well.

Closing this case.

[MP18]

@DongQu 

Thanks for updating us with very useful info.

Regards