04-23-2020 11:21 AM
We've published GlobalProtect 5.0.5
I added some Exclude Domains and Applications to our Gateway's Split-Tunnel configuration over the weekend. Afterwards, about 5-10% of our VPN clients can not access these domains at all while on VPN. The domains work fine when disconnected. We've had reports of problems with Mac and Windows, but all of my testing has been on Windows.
I've found this simple test detects the problem. The test works with any domain in the exclude domains list. In this case, I've added "*.zoom.us" to the list.
Open powershell and run the command
$tc = New-Object System.Net.Sockets.TcpClient("www.zoom.us",80)On computers that are ok, that command will have no output. On computers with the problem, the output is like
New-Object : Exception calling ".ctor" with "2" argument(s): "The requested address is not valid in its context 3.235.72.190:80"Any application that tries to access these domains fails with similar errors. For example, some browsers show ERR_ADDRESS_INVALID
I'm wondering if anybody else has encountered something like this.
06-02-2021 08:57 AM - edited 06-03-2021 02:00 AM
Has someone also tested the Split DNS to exclude also the DNS traffic for the affected domains if this helps as maybe as written in the article for zoom split tunnel palo alto does not know the full ip list of the zoom domains and also the exclusion could be just if zoom is installed in the corect folder ?
Split DNS:
Zoom split tunnel:
06-14-2021 01:13 PM - edited 06-15-2021 11:47 AM
Also atleast for zoom there is a new article that uses the enchanced spllit tunnel by app process and domain (https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-new-features/globalprotect-features/split-tunnel...) as some fqdn like zoom have too many dinamic ip addresses that change and this could be the issue as maybe sometimes some traffic is send over the tunnel other is not. I am thinking of this as the F5 BIG-IP APM module that is also for VPN and other things has article " K91493443: Network Access - Microsoft Teams application not honoring split tunneling exclusion address space " and their solution is to block the traffic that is going to the zoom servers if it is sourced by the a VPN ip address. In other words the zoom and other applications addresses change too often and even the DNS FQDN resolution may return a different list to the clients or the Palo Alto firewall if split DNS is not enabled, so maybe this is why I think testing with excluding the application processes and split dns for zoom and other applications with many dynamic ip addresses as the best option if this is the issue.
Has anyone followed this article and enabled split DNS and still having the issue with zoom?
08-01-2022 04:51 PM - edited 08-01-2022 04:52 PM
This is still happening even on 5.2.12-26 and in our case on an INCLUDED domain.
it seems that whatever the GPS service is doing to hook the kernel for intercepting tcp/udp socket attempts gets into a bad state for certain IPs on some unknown condition... and once they are in that state only a restart of the service to clear the table in memory will fix it.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
