No Direct Access to Local Network Support for Linux

Software Support
: Starting with GlobalProtect™ app 6.0 and running PAN-OS 9.1.0 and later releases.
OS Support
: Linux (CentOS, Red Hat Enterprise Linux (RHEL), and Ubuntu)
You can now enable or disable local network access whenever end users are connected to GlobalProtect for Linux endpoints. You can configure the access route to define the specific destination IP subnet traffic that is sent (or not sent) over the VPN tunnel for Linux endpoints. Local routes take precedence over routes sent from the gateway. Therefore, end users can reach proxies and local resources (such as local printers) directly without sending any local subnet traffic through the VPN tunnel. By configuring traffic by access routes, you can send latency sensitive or high bandwidth consuming traffic outside of the VPN tunnel while routing all other traffic through the VPN for inspection and policy enforcement by the GlobalProtect gateway. By disabling the split tunnel, you can force all traffic (including local subnet traffic) to go through the VPN tunnel for inspection and policy enforcement.
The following diagram illustrates the challenges of remote end users unable to access proxies and local resources (such as local printers) directly when all traffic is going through the VPN tunnel for inspection and policy enforcement while connected to GlobalProtect.
You can consider the IPv4 and IPv6 traffic behavior based on whether you enable or disable direct access to local networks.
  1. Before you begin:
    1. Select
      Network
      GlobalProtect
      Gateways <
      <gateway-config>
      to modify an existing gateway or add a new one.
  2. Enable a split tunnel.
    1. In the
      GlobalProtect Gateway Configuration
      dialog, select
      Agent
      Tunnel Settings
      to enable
      Tunnel Mode
      .
    2. Configure the tunnel parameters for the GlobalProtect app.
  3. (
    Tunnel Mode only
    ) Disable the split tunnel to ensure that all traffic (including local subnet traffic) goes through the VPN tunnel for inspection and policy enforcement.
    1. In the
      GlobalProtect Gateway Configuration
      dialog, select
      Agent
      Client Settings
      <client-setting-config>
      to select an existing client settings configuration or add a new one.
    2. Select
      Split Tunnel
      Access Route
      and then enable the
      No direct access to local network
      option.
      If you enable this option, direct access to local network is disabled and users cannot send traffic directly to proxies or local resources while connected to GlobalProtect. Split tunnel traffic based on access route, destination domain, and application still works as expected.
  4. (
    Tunnel Mode only
    ) Configure split tunnel settings based on the access route.
    You can route certain traffic to be included or excluded from the tunnel by specifying the destination subnets or address object (of type
    IP Netmask
    ).
    1. In the
      GlobalProtect Gateway Configuration
      dialog, select
      Agent
      Client Settings
      <client-setting-config>
      to select an existing client settings configuration or add a new one.
    2. Configure any of the following access route-based
      Split Tunnel
      settings (
      Split Tunnel
      Access Route
      ):
      • In the
        Include
        area,
        Add
        the destination subnets or address object (of type
        IP Netmask
        ) to route only certain traffic destined for your LAN to GlobalProtect. You can include IPv6 or IPv4 subnets.
        The firewall supports up to 100 include access routes in a split tunnel gateway configuration.
      • In the
        Exclude
        area,
        Add
        the destination subnets or address object (of type
        IP Netmask
        ) that you want the app to exclude. Excluded routes should be more specific than the included routes; otherwise, you may exclude more traffic than intended. You can exclude IPv6 or IPv4 subnets. The firewall supports up to 100 exclude access routes in a split tunnel gateway configuration.
    3. Click
      OK
      to save the split tunnel configuration.
  5. Save the gateway configuration.
    1. Click
      OK
      to save the settings.
    2. Commit
      the changes.
  6. Verify that the GlobalProtect app for Linux no longer has access to the local network.
    To verify this, check the routing table and notice that the local route is shadowed as in the following example.

Recommended For You