GlobalProtect
Configure a Split Tunnel Based on the Access Route
Table of Contents
Expand All
|
Collapse All
GlobalProtect Docs
-
- 10.1 & Later
- 9.1 (EoL)
-
- 6.3
- 6.2
- 6.1
- 6.0
- 5.1
-
- 6.1
- 6.0
- 5.1
-
- 6.3
- 6.2
- 6.1
- 6.0
- 5.1
End-of-Life (EoL)
Configure a Split Tunnel Based on the Access Route
Configure a split tunnel based on the access route.
If you do not include or exclude routes, every
request is routed through the VPN tunnel (without a split tunnel).
You can include or exclude specific destination IP subnet traffic
from being sent over the VPN tunnel. The routes that you send through
the VPN tunnel can be defined either as the routes you include in
the tunnel, or as routes that you exclude from the tunnel, or both.
For example, you can set up a split tunnel to allow remote users
to access the internet without going through the VPN tunnel. More
specific routes take precedence over less-specific routes.
When
you define split tunnel traffic to include access routes, these
are the routes that the gateway pushes to the remote users’ endpoints
to specify what traffic the users’ endpoints can send through the
VPN tunnel. When you define split tunnel traffic to exclude access
routes, these routes are sent through the physical adapter on the
endpoint instead of sent through the GlobalProtect VPN tunnel through
the virtual adapter (the tunnel). By excluding split tunnel traffic
by access routes, you can send latency sensitive or high bandwidth
consuming traffic outside of the VPN tunnel while all other traffic
is routed through the VPN for inspection and policy enforcement
by the GlobalProtect gateway.
Local routes take precedence
over routes sent from the gateway. When you enable the split tunnel,
users can reach proxies and local resources (such as local printers)
directly without sending any local subnet traffic through the VPN
tunnel. By disabling the split tunnel, you can force all traffic
to go through the VPN tunnel for inspection and policy enforcement
whenever users are connected to GlobalProtect. You can consider
the following IPv4 and IPv6 traffic behavior based on whether you enable
or disable direct access to local networks.
IPv4 Traffic to Local Subnet | No Direct Access to Local Network
is Enabled | No Direct Access to Local Network
is Disabled | ||
---|---|---|---|---|
Before the tunnel is established | After the tunnel is established | Before the tunnel is established | After the tunnel is established | |
New Incoming Traffic | Traffic is allowed on the local subnet through
the physical adapter. | (Windows 10 only) When split tunneling
based on the destination domain and application is not enabled,
traffic adhering to the routing table is sent through the VPN tunnel. However,
certain applications can still bind to a specific interface directly
and route the traffic through physical interface ignoring the routing table. When
you enable split tunneling based on the destination domain and application, traffic
is allowed on the local subnet through the physical adapter. (macOS
only) Traffic is allowed on the local subnet through the physical adapter. | Traffic is allowed on the local subnet through
the physical adapter. | Traffic is allowed on the local subnet through
the physical adapter. |
New Outgoing Traffic | Traffic is allowed on the local subnet through
the physical adapter. | Traffic is sent through the VPN tunnel. | Traffic is allowed on the local subnet through
the physical adapter. | Traffic is allowed on the local subnet through
the physical adapter. |
Existing Traffic | Traffic is allowed on the local subnet through
the physical adapter. | (Windows) Traffic is terminated. (macOS
and Linux) Traffic is allowed on the local subnet through the
physical adapter. | Traffic is allowed on the local subnet through
the physical adapter. | Traffic is allowed on the local subnet through
the physical adapter. |
IPv6 Traffic to Local Subnet | No Direct Access to Local Network
is Enabled | No Direct Access to Local Network
is Disabled | ||
---|---|---|---|---|
Before the tunnel is established | After the tunnel is established | Before the tunnel is established | After the tunnel is established | |
New Incoming Traffic | Traffic is allowed on the local subnet through
the physical adapter. | Traffic is allowed on the local subnet through
the physical adapter. | Traffic is allowed on the local subnet through
the physical adapter. | Traffic is allowed on the local subnet through
the physical adapter. |
New Outgoing Traffic | Traffic is allowed on the local subnet through
the physical adapter. | Traffic (except fe80::/10 link-local addresses)is
sent through the VPN tunnel. | Traffic is allowed on the local subnet through
the physical adapter. | Traffic is allowed on the local subnet through
the physical adapter. |
Existing Traffic | Traffic is allowed on the local subnet through
the physical adapter. | Traffic is allowed on the local subnet through
the physical adapter. | Traffic is allowed on the local subnet through
the physical adapter. | Traffic is allowed on the local subnet through
the physical adapter. |
Use the following steps to configure a split
tunnel based on access routes.
- Before you begin:
- Configure a GlobalProtect gateway.
- Select NetworkGlobalProtectGateways<gateway-config> to modify an existing gateway or add a new one.
- Enable a split tunnel.
- In the GlobalProtect Gateway Configuration dialog, select AgentTunnel Settings to enable Tunnel Mode.
- Configure the tunnel parameters for the GlobalProtect app.
- (Tunnel Mode only) Disable the split tunnel
to ensure that all traffic (including local subnet traffic) goes
through the VPN tunnel for inspection and policy enforcement.
- In the GlobalProtect Gateway Configuration dialog, select AgentClient Settings<client-setting-config> to select an existing client settings configuration or add a new one.
- Select Split TunnelAccess Route and then enable
the No direct access to local network option. If you enable this option, direct access to local network is disabled and users cannot send traffic directly to proxies or local resources while connected to GlobalProtect. Split tunnel traffic based on access route, destination domain, and application still works as expected.
- (Tunnel Mode only) Configure split tunnel settings based
on the access route.The split tunnel settings are assigned to the virtual network adapter on the endpoint when the GlobalProtect app establishes a tunnel with the gateway.Avoid specifying the same access route as both an include and an exclude access route; doing so results in a misconfiguration.You can route certain traffic to be included or excluded from the tunnel by specifying the destination subnets or address object (of type IP Netmask).
- In the GlobalProtect Gateway Configuration dialog, select AgentClient Settings<client-setting-config> to select an existing client settings configuration or add a new one.
- Configure any of the following access route-based Split
Tunnel settings (Split TunnelAccess Route):
- (Optional) In the Include area, Add the destination subnets or address object (of type IP Netmask) to route only certain traffic destined for your LAN to GlobalProtect. You can include IPv6 or IPv4 subnets.On PAN-OS 8.0.2 and later releases, up to 100 access routes can be used to include traffic in a split tunnel gateway configuration. Unless combined with GlobalProtect app 4.1.x or a later release, up to 1,000 access routes can be used.
- (Optional) In the Exclude area, Add the destination subnets or address object (of type IP Netmask) that you want the app to exclude. Excluded routes should be more specific than the included routes; otherwise, you may exclude more traffic than intended. You can exclude IPv6 or IPv4 subnets. The firewall supports up to 100 exclude access routes in a split tunnel gateway configuration. Unless combined with GlobalProtect app 4.1 and later releases, then up to 200 exclude access routes can be used.You cannot exclude access routes for endpoints running Android on Chromebooks. Only IPv4 routes are supported on Chromebooks.
- Click OK to save the split tunnel configuration.
- Save the gateway configuration.
- Click OK to save the settings.
- Commit the changes.