04-20-2021 05:13 AM - edited 04-22-2021 03:27 AM
Hi We had recently configured split tunneling on our firewall and had allowed certain subnets via access routes and domains on include domain list.
For security purpose changing the domain names:
We had added *.google.com on our domain include list to allow access of sites under that domain.
When the end user connects to GPVPN and accesses the google.com it is going through GP-VPN-->F/W-->ISP
If we try to access subdomains like admin-dashboard.google.com the traffic is routed through the end user Local ISP.
We had configured Internal IP address on Agent DNS IP Setting.
Here the DNS Query to admin-dashboard.google.com is send to tunnel but the HTTPS traffic to admin-dashboard.google.com is going through end user local ISP
Global VPN GlobalProtect: Implement Split Tunnel Domain and Applications DNS issue over Global Protect split tunnel
04-21-2021 10:05 PM
The wildcard is working as expected. It means anything before .google.com so this will not include google.com so just add both to the split domains.
nslookup and similar apps will not use the same engine as your browser so the split domain settings will not work for them.
I usually add to browser and wireshark on port 53 to test DNS resolution.
04-22-2021 03:23 AM
Hi @MickBall Thanks for your reply.
Issue 1: we had added both google.com and admin-dashobard.google.com to the include domain in the split tunnel but still the traffic is going via end user local nw for the admin-dashboard.google.com site.
Do we need to uninstall and reinstall the GP Client for the settings to get reflected at endpoints.
Issue 2: We had configured an internal DNS for querying of GP users. Had checked with Wireshark by doing packet capture of GP tunnel could see DNS traffic is successfully send via GP Tunnel but the traffic for admin-dashobard.google.com is still going through local ethernet.
All the GP client are Mac OS.
Any thoughts on this on how to proceed further.
04-28-2021 11:14 PM
Hi @MickBall I would not be able to share the screenshot of the access routes and domain/application tab as it contains sensitive datas. But now the traffic to that particular sub-domain is passing thru split tunnel but after some time it is being routed thru end-user network. The subdomain is having dynamic IP and it is deployed in AWS. The DNS name resolution is done using internal private DNS server.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!