I need your help on how to troubleshoot an issue related to global protect.
On our Access routes, no 0.0.0.0 are configured.
We wanted to let users use their local gateway for any traffic destined to the internet.
But they are receiving the 0.0.0.0 in their RoutePrint resulting to traversing their any traffic to the VPN.
This is clogging our network.
I already engaged 3 TAC on this but could not find the issue.
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.0.1 192.168.0.199 35
0.0.0.0 0.0.0.0 On-link 10.0.0.201 50
default routes 0.0.0/0 always apply whether using split tunnel or not.
your more specific routes /32 /24/23 etc will take precedence over /0
is there any more information in your route print or have you just left it out.....
Hmmm there must be something odd with your settings if thats the case...
I have a test gateway that only includes 10.0.0.0/8
route print below...
so any unknown traffic such as 22.214.171.124 has 2 default routes but the local interface has a lower metric (35) so no traffic goes down the tunnel unless its within 10.0.0.0/8.
Perhaps your metric is the other way round for some odd reason, i would only think this would happen if you had just exclude routes in your settings.
I have to agree with @MickBall the 0.0.0.0/0 route will still be in the routing table but the host will see this as a backup route, the 0.0.0.0/0 route that is via your home network gateway will be used as its metric is takes precedence over the one through the Global protect tunnel, if you were, for instance, to configure the Global Protect to tunnel all traffic then the metrics would be the other way around.
As it is your include routes are tunnelled and the host will only use the GP default route should the 192 gateway become unavailable, however that would also cut off your connectivity so you would have bigger issues!
My logic behind excluding the 0.0.0.0/0 route was simply that by actively excluding it, it may not find it's way into the routing table at all.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!