Configure a Split Tunnel Based on the Access Route

Table of Contents

Split Tunnel Traffic on GlobalProtect Gateways

Configure a Split Tunnel Based on the Domain and Application

Configure a split tunnel based on the access route.

If you do not include or exclude routes, every request is routed through the GlobalProtect tunnel (without a split tunnel). You can include or exclude specific destination IP subnet traffic from being sent over the GlobalProtect tunnel. You can define the routes to send through the tunnel as routes to include in the tunnel, or as routes to exclude from the tunnel, or both. For example, you can set up a split tunnel to allow remote users to access the internet without going through the VPN tunnel. More specific routes take precedence over less-specific routes.

When you define split tunnel traffic to include access routes, these are the routes that the gateway pushes to the remote users’ endpoints to specify what traffic the users’ endpoints can send through the VPN tunnel. When you define split tunnel traffic to exclude access routes, these routes are sent through the physical adapter on the endpoint instead of sent through the GlobalProtect VPN tunnel through the virtual adapter (the tunnel). By excluding split tunnel traffic by access routes, you can send latency sensitive or high bandwidth consuming traffic outside of the VPN tunnel while all other traffic is routed through the VPN for inspection and policy enforcement by the GlobalProtect gateway. You can force all traffic to go through the VPN tunnel for inspection and policy enforcement whenever users are connected to GlobalProtect by disabling the split tunnel.

Local routes take precedence over routes sent from the gateway. When you enable the split tunnel, users can reach proxies and local resources (such as local printers) directly without sending any local subnet traffic through the VPN tunnel. To prevent endpoints from sending and receiving traffic on the local subnet to bypass policy enforcement instead of sending it through the tunnel you can enable the No direct access to local network setting on Windows, macOS, and Linux endpoints (Linux endpoints must be running GlobalProtect app version 6.0.0 or later). Split tunnel traffic based on access route, destination domain, and application still works as expected when No direct access to local network is enabled.

Enable the No direct access to local network setting to reduce risks in untrusted networks such as rogue Wi-Fi access points.

Consider the following IPv4 and IPv6 traffic behavior based on whether you enable or disable direct access to local networks.

IPv4 Traffic Behavior

IPv4 Traffic to Local Subnet	No Direct Access to Local Network is Enabled		No Direct Access to Local Network is Disabled
	Before the tunnel is established	After the tunnel is established	Before the tunnel is established	After the tunnel is established
New Incoming Traffic	Traffic is allowed on the local subnet through the physical adapter.	(`Windows 10 only`) When split tunneling based on the destination domain and application is not enabled, traffic adhering to the routing table is sent through the VPN tunnel. Certain applications can still bind to a specific interface directly and route the traffic through physical interface ignoring the routing table. When you enable split tunneling based on the destination domain and application, traffic is allowed on the local subnet through the physical adapter. (`macOS and Linux`) Traffic is allowed on the local subnet through the physical adapter.	Traffic is allowed on the local subnet through the physical adapter.	Traffic is allowed on the local subnet through the physical adapter.
New Outgoing Traffic	Traffic is allowed on the local subnet through the physical adapter.	Traffic is sent through the VPN tunnel.	Traffic is allowed on the local subnet through the physical adapter.	Traffic is allowed on the local subnet through the physical adapter.
Existing Traffic	Traffic is allowed on the local subnet through the physical adapter.	(`Windows`) Traffic is terminated. (`macOS and Linux`) Traffic is allowed on the local subnet through the physical adapter.	Traffic is allowed on the local subnet through the physical adapter.	Traffic is allowed on the local subnet through the physical adapter.

IPv6 Traffic Behavior

IPv6 Traffic to Local Subnet	No Direct Access to Local Network is Enabled		No Direct Access to Local Network is Disabled
	Before the tunnel is established	After the tunnel is established	Before the tunnel is established	After the tunnel is established
New Incoming Traffic	Traffic is allowed on the local subnet through the physical adapter.	Traffic is allowed on the local subnet through the physical adapter.	Traffic is allowed on the local subnet through the physical adapter.	Traffic is allowed on the local subnet through the physical adapter.
New Outgoing Traffic	Traffic is allowed on the local subnet through the physical adapter.	Traffic (except fe80::/10 link-local addresses) is sent through the VPN tunnel.	Traffic is allowed on the local subnet through the physical adapter.	Traffic is allowed on the local subnet through the physical adapter.
Existing Traffic	Traffic is allowed on the local subnet through the physical adapter.	Traffic is allowed on the local subnet through the physical adapter.	Traffic is allowed on the local subnet through the physical adapter.	Traffic is allowed on the local subnet through the physical adapter.

Use the following steps to configure a split tunnel based on access routes.

Before you begin:
1. Configure a GlobalProtect gateway.
2. Select NetworkGlobalProtectGateways<gateway-config> to modify an existing gateway or add a new one.
Enable a split tunnel.
1. In the GlobalProtect Gateway Configuration dialog, select AgentTunnel Settings to enable Tunnel Mode.
2. Configure the tunnel parameters for the GlobalProtect app.
(Tunnel Mode only) Disable the split tunnel to ensure that all traffic (including local subnet traffic) goes through the VPN tunnel for inspection and policy enforcement.
1. In the GlobalProtect Gateway Configuration dialog, select AgentClient Settings<client-setting-config> to select an existing client settings configuration or add a new one.
2. Select Split TunnelAccess Route and then enable the No direct access to local network option.
  
  If you enable this option, direct access to local network is disabled and users cannot send traffic directly to proxies or local resources while connected to GlobalProtect. Split tunnel traffic based on access route, destination domain, and application still works as expected.
(Tunnel Mode only) Configure split tunnel settings based on the access route.
The split tunnel settings are assigned to the virtual network adapter on the endpoint when the GlobalProtect app establishes a tunnel with the gateway.

Avoid specifying the same access route as both an include and an exclude access route; doing so results in a misconfiguration.

You can route certain traffic to be included or excluded from the tunnel by specifying the destination subnets or address object (of type IP Netmask).
1. In the GlobalProtect Gateway Configuration dialog, select AgentClient Settings<client-setting-config> to select an existing client settings configuration or add a new one.
2. Configure any of the following access route-based Split Tunnel settings (Split TunnelAccess Route):
  (Optional) In the Include area, Add the destination subnets or address object (of type IP Netmask) to route only certain traffic destined for your LAN to GlobalProtect. You can include IPv6 or IPv4 subnets.
  On PAN-OS 8.0.2 and later releases, up to 100 access routes can be used to include traffic in a split tunnel gateway configuration. Unless combined with GlobalProtect app 4.1.x or a later release, up to 1,000 access routes can be used.
  (Optional) In the Exclude area, Add the destination subnets or address object (of type IP Netmask) that you want the app to exclude. Excluded routes should be more specific than the included routes; otherwise, you may exclude more traffic than intended. You can exclude IPv6 or IPv4 subnets. The firewall supports up to 100 exclude access routes in a split tunnel gateway configuration. Unless combined with GlobalProtect app 4.1 and later releases, then up to 200 exclude access routes can be used.
  
  You cannot exclude access routes for endpoints running Android on Chromebooks. Only IPv4 routes are supported on Chromebooks.
3. Click OK to save the split tunnel configuration.
Save the gateway configuration.
1. Click OK to save the settings.
2. Commit the changes.

Split Tunnel Traffic on GlobalProtect Gateways

Configure a Split Tunnel Based on the Domain and Application

GlobalProtect Docs

Configure a Split Tunnel Based on the Access Route

GlobalProtect Docs