Global Protect Split Tunneling with multiple network adapters

[Peter_Keller]

Hey community,

We are struggling with a certain case for many of our customers.

We have many users working in service who connect to #GlobalProtect with their Windows notebooks via mobile data to #Prisma Cloud. From there, they access the internet or internal resources. We have some bypassed decryption rules.

For their work, they need to connect via Ethernet to a second network, but they cannot reach it with an established tunnel. I think Split Tunneling would be the right solution.

However, even if I don't disable access to the local network and exclude the traffic (10.3.33.0/24) for the second network, it is still not reachable. Traceroute shows that it is trying to route the packets through the tunnel.

Does split tunneling in GlobalProtect only bypass traffic from the VPN tunnel and not use another adapter?

For more explanation, I have added a drawing.

Any ideas or experiences?

Thanks in advance, Peter

[BPry]

@Peter_Keller,

I think what you would have to do here going forward is setup a GlobalProtect login script on the machines to properly update the routes to get this to function properly. You'll have to do some testing to ensure that the routes you install are properly removed upon a disconnect.

[PeterKeller]

Thank you BPry for you reply.

So you would run a f.e. powershell script as post-vpn-command to set routes to certain networks?

I don't think this will solve our problem, we connect sometimes to private networks and don't know the networks. Would it even work if the pan adapter uses metric 1?