What does No Direct access to Local Network actually do and when do we use it??

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.
Palo Alto Networks Approved
Palo Alto Networks Approved
Community Expert Verified
Community Expert Verified

What does No Direct access to Local Network actually do and when do we use it??

L3 Networker

Team,


Can anyone please explain SIMPLY to me what  the "No Direct access to Local Network " under Global Protect actually does and mostly when are supposed to use it?

 

This is so confusing to me. I know there is a KB for this but the KB seems to confuse people more then help. Basically what does it block and when should we enable it? Full tunnel? Split tunnel? Only split tunnel domain?

1 accepted solution

Accepted Solutions

Cyber Elite
Cyber Elite
6 REPLIES 6

Cyber Elite
Cyber Elite

@Schneur_Feldman,

It restricts outgoing traffic on the local connected subnet. Instead of that traffic exiting through the local physical adapter like you would expect, the traffic is sent through the tunnel and (usually) dropped by the firewall. There's some behavioral considerations when it comes to existing traffic since macOS won't terminate the existing sessions like Windows does.

 

When you enable this feature really depends on your own configuration/environment requirements. I'd personally recommend enabling it across the board, but I know some environments don't go that far because it breaks local network functions like network printing to someone's home printer.

Cyber Elite
Cyber Elite

Hello,

This feature is to satisfy compliance requirements around 'No Split Tunneling'. Prevents a user from being on VPN and connecting to their other systems on their home network (as an example).

 

Hope this helps.

L3 Networker

So just so I understand, if my home subnet is 192.168.1.0 and my GP subnet is 10.0.0.0 when I enable  "No Direct access to Local Network " I wont be able to access for example a printer on my 192.168.1.0 network?

 

Essentially just cutting off Local LAN access?

Cyber Elite
Cyber Elite

@Schneur_Feldman,

Correct

L3 Networker

Thank you so much team!!! Really helpful information@!

Thank you so much team!!! Really helpful information@!

  • 1 accepted solution
  • 4502 Views
  • 6 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!