We have set split tunnel for our Win10 clients, GP is version 5.1.6 and 5.2.5. PAN-OS is 9.1.7.
- default route to firewall
- bypass tunnel for some network ranges (e.g. MS-Teams)
- bypass tunnel for some URLs (e.g. MS-Teams)
- enable DNS-Split
For a small fractions of the users I see the MS-Teams traffic sent back to the firewall (expected was it is bypassing the tunnel).
The routing table on the client looks correct. Based on the routes the traffic should never be sent via the tunnel.
We tried to remedy a potential issue with the network interface with "netsh int ip reset" as administrator, same result.
Any idea what could cause such a strange behavior?
I would recommend to you to take logs from the Global Protect Client at the time when user is trying to connect to Teams.
I would also collect logs from FW from user IP to see what is destination of Teams Server that user is trying to connect. Microsoft is adding IP ranges all the time for different servers around the world. How many Agents Portals, Gateways did you create?
@Pawel_G group mapping is not controlled through the User-ID agent, so losing connection can't impact group mapping
@JoergSchuetter have you tried reinstalling+upgrading to 5.1.8 the GP agent on one of the affected devices? I've seen something similar both with a bug in the GP agent, and an install that somehow failed to properly bind the gp virtual interface
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!