GlobalProtect Split-Tunnel via cli.

[Mick_Ball]

I am trying to add the MS IP's via cli for split-tunnelling.

the documentation states the following...

set network tunnel global-protect-site-to-site <name> client split-tunneling access-route [ <access-route1>

but this is not working on 8.1.9

I can get this far..

set network tunnel global-protect-gateway "gateway-name"  but cannot configure the client settings.

any useful docs would be much appreciated.

[Mick_Ball · Accepted solution]

This has been resolved by @goran.katava 

set global-protect global-protect-gateway GATEWAY-NAME remote-user-tunnel-configs CONFIG-NAME split-tunneling exclude-access-route

Superstar....

[StephenG]

This path does not work when the device is managed by Panorama:

> edit template <NAME> config vsys vsys1 global-protect global-protect-gateway <NAME> remote-user-tunnel-configs <NAME> split-tunneling

The only options after that point are:

exclude-domains Domains need to go out of tunnel
include-domains Domains need to go through tunnel
<Enter> Finish input

However if I do a show at that point, it clearly shows remaining configuration:

...

exclude-access-route [ 1.1.1.1/32 .....]

...

[StephenG]

<edit>

It seems to work if you are using the SET command in cli not edit to select path:

> set template <NAME> config vsys vsys1 global-protect global-protect-gateway <NAME> remote-user-tunnel-configs <NAME> split-tunneling exclude-access-route 1.1.1.1/32