GP Access Routes

[rmfalconer]

Is there any way to negate adding a prefix to the GP Access Routes? We have an app that we don't want to change the communication path when a machine connects with GP. So if it was accessing this app through an external method it should remain that way.

If the app is using address 1.1.1.1 prior to connecting with GP, then the access routes would be 0/0 but not 1.1.1.1. 

Negation is possible in other places on the PA but I don't see a way to do it with the access routes.

[SuryaR]

May I please know what PAN-OS version and GP -version are you using..

[BPry · Accepted solution]

@rmfalconer,

If you are running anything above 8.0 then you can add an excluded access route so that the address isn't passed through the tunnel, prior to that you do not have that ability. 

[rmfalconer]

We are running 7.1.9 and GP 3.1.6 so it looks like it's not supported yet.

[SuryaR]

Yes negate option is added only if you use 8.0.x +4.0.x. 

It doesnt work with 8.0.x and 3.x.x versions. 

Hope this helps. 

[Remo]

It is (a lot) more awful, but it is also possible with your software versions. You "simply" have to add all IP subnets except the one IP ...

0.0.0.0/8

1.0.0.0/16

1.1.0.0/24

1.1.1.0/32

1.1.1.2/31

1.1.1.4/30

1.1.1.8/29

1.1.1.16/28

1.1.1.32/27

1.1.1.64/26

1.1.1.128/25

1.1.2.0/23

1.1.4.0/22

1.1.8.0/21

1.1.16.0/20

1.1.32.0/19

1.1.64.0/18

1.1.128.0/17

1.2.0.0/15

1.4.0.0/14

1.8.0.0/13

1.16.0.0/12

1.32.0.0/11

1.64.0.0/10

1.128.0.0/9

2.0.0.0/7

4.0.0.0/6

8.0.0.0/5

16.0.0.0/4

32.0.0.0/3

64.0.0.0/2

128.0.0.0/1