DNS traffic outside of GlobalProtect tunnel

[MikeHinz]

Hello,

We use Global Protect to connect our employees via VPN to our site. We think we have configured it that way, that the complete traffic is tunneled to our site after establishing the Global Portect connection.

Now we see that unencrypted DNS traffic is visible outside the tunnel. The target adress of that DNS traffic is the IP of our Global Protect gateway (where also the DNS proxy resides). 

Why is this traffic not encrypted an transported via the Global Protect connection and do you have any suggestion which options could be the reason for that behaviour?

[Claw4609]

Hello,

What does your split tunnel configuration look like? Is it just include 0.0.0.0/0? Under the app configuration of the portal there is also a flag for "Split-Tunnel-Option" what do you have selected for that?

Thanks,

Bradley Fergel

[BPry · Accepted solution]

@MikeHinz,

You would expect to see some limited DNS traffic happen outside of the tunnel for things like internal host detection. I'd look at what is actually being sent outside of the tunnel to validate, but you're likely seeing that traffic and it's nothing to worry about.

[arusharma]

Check these settings on the App: https://docs.paloaltonetworks.com/globalprotect/5-2/globalprotect-app-new-features/new-features-rele....

Split tunnel Options and Resolve all FQDNs. If its still leaking out of Physical interface try different GP version.