GlobalProtect
Configure a Split Tunnel Based on the Access Route
Table of Contents
Configure a Split Tunnel Based on the Access Route
Configure a split tunnel based on the access route.
If you do not include or exclude routes, every request is routed through the GlobalProtect tunnel
(without a split tunnel). You can include or exclude specific destination IP subnet
traffic from being sent over the GlobalProtect tunnel. You can define the routes to
send through the tunnel as routes to include in the tunnel, or as routes to exclude
from the tunnel, or both. For example, you can set up a split tunnel to allow remote
users to access the internet without going through the VPN tunnel. More specific
routes take precedence over less-specific routes.
When you define split tunnel traffic to include access routes, these are the routes that the
gateway pushes to the remote users’ endpoints to specify what traffic the users’
endpoints can send through the VPN tunnel. When you define split tunnel traffic to
exclude access routes, these routes are sent through the physical adapter on the
endpoint instead of sent through the GlobalProtect VPN tunnel through the virtual
adapter (the tunnel). By excluding split tunnel traffic by access routes, you can
send latency sensitive or high bandwidth consuming traffic outside of the VPN tunnel
while all other traffic is routed through the VPN for inspection and policy
enforcement by the GlobalProtect gateway. You can force all traffic to go through
the VPN tunnel for inspection and policy enforcement whenever users are connected to
GlobalProtect by disabling the split tunnel.
Local routes take precedence over routes sent from the gateway. When you enable the split tunnel,
users can reach proxies and local resources (such as local printers) directly
without sending any local subnet traffic through the VPN tunnel. To prevent
endpoints from sending and receiving traffic on the local subnet to bypass policy
enforcement instead of sending it through the tunnel you can enable the No direct
access to local network setting on Windows, macOS, and Linux endpoints (Linux
endpoints must be running GlobalProtect app version 6.0.0 or later). Split tunnel
traffic based on access route, destination domain, and application still works as
expected when No direct access to local network is enabled.
Enable the No direct access to local
network setting to reduce risks in untrusted networks such as rogue Wi-Fi access
points.
Consider the following IPv4 and IPv6 traffic behavior based on whether you enable or
disable direct access to local networks.
IPv4 Traffic to Local Subnet | No Direct Access to Local Network
is Enabled | No Direct Access to Local Network
is Disabled | ||
|---|---|---|---|---|
Before the tunnel is established | After the tunnel is established | Before the tunnel is established | After the tunnel is established | |
New Incoming Traffic | Traffic is allowed on the local subnet through
the physical adapter. | (Windows 10 only) When split tunneling
based on the destination domain and application is not enabled,
traffic adhering to the routing table is sent through the VPN tunnel. Certain applications
can still bind to a specific interface directly and route the traffic through
physical interface ignoring the routing table. When you enable
split tunneling based on the destination domain and application, traffic
is allowed on the local subnet through the physical adapter. (macOS
and Linux) Traffic is allowed on the local subnet through the
physical adapter. | Traffic is allowed on the local subnet through
the physical adapter. | Traffic is allowed on the local subnet through
the physical adapter. |
New Outgoing Traffic | Traffic is allowed on the local subnet through
the physical adapter. | Traffic is sent through the VPN tunnel. | Traffic is allowed on the local subnet through
the physical adapter. | Traffic is allowed on the local subnet through
the physical adapter. |
Existing Traffic | Traffic is allowed on the local subnet through
the physical adapter. | (Windows) Traffic is terminated. (macOS
and Linux) Traffic is allowed on the local subnet through the
physical adapter. | Traffic is allowed on the local subnet through
the physical adapter. | Traffic is allowed on the local subnet through
the physical adapter. |
IPv6 Traffic to Local Subnet | No Direct Access to Local Network
is Enabled | No Direct Access to Local Network
is Disabled | ||
|---|---|---|---|---|
Before the tunnel is established | After the tunnel is established | Before the tunnel is established | After the tunnel is established | |
New Incoming Traffic | Traffic is allowed on the local subnet through
the physical adapter. | Traffic is allowed on the local subnet through
the physical adapter. | Traffic is allowed on the local subnet through
the physical adapter. | Traffic is allowed on the local subnet through
the physical adapter. |
New Outgoing Traffic | Traffic is allowed on the local subnet through
the physical adapter. | Traffic (except fe80::/10 link-local addresses)
is sent through the VPN tunnel. | Traffic is allowed on the local subnet through
the physical adapter. | Traffic is allowed on the local subnet through
the physical adapter. |
Existing Traffic | Traffic is allowed on the local subnet through
the physical adapter. | Traffic is allowed on the local subnet through
the physical adapter. | Traffic is allowed on the local subnet through
the physical adapter. | Traffic is allowed on the local subnet through
the physical adapter. |
Use the following steps to configure a split
tunnel based on access routes.
- Before you begin:
- Configure a GlobalProtect gateway.Select to modify an existing gateway or add a new one.Enable a split tunnel.
- In the GlobalProtect Gateway Configuration dialog, select to enable Tunnel Mode.Configure the tunnel parameters for the GlobalProtect app.(Tunnel Mode only) Disable the split tunnel to ensure that all traffic (including local subnet traffic) goes through the VPN tunnel for inspection and policy enforcement.
- In the GlobalProtect Gateway Configuration dialog, select to select an existing client settings configuration or add a new one.Select and then enable the No direct access to local network option.If you enable this option, direct access to local network is disabled and users cannot send traffic directly to proxies or local resources while connected to GlobalProtect. Split tunnel traffic based on access route, destination domain, and application still works as expected.(Tunnel Mode only) Configure split tunnel settings based on the access route.The split tunnel settings are assigned to the virtual network adapter on the endpoint when the GlobalProtect app establishes a tunnel with the gateway.Avoid specifying the same access route as both an include and an exclude access route; doing so results in a misconfiguration.You can route certain traffic to be included or excluded from the tunnel by specifying the destination subnets or address object (of type IP Netmask).
- In the GlobalProtect Gateway Configuration dialog, select to select an existing client settings configuration or add a new one.Configure any of the following access route-based Split Tunnel settings ():
- (Optional) In the Include area, Add the destination subnets or address object (of type IP Netmask) to route only certain traffic destined for your LAN to GlobalProtect. You can include IPv6 or IPv4 subnets.On PAN-OS 8.0.2 and later releases, up to 100 access routes can be used to include traffic in a split tunnel gateway configuration. Unless combined with GlobalProtect app 4.1.x or a later release, up to 1,000 access routes can be used.
- (Optional) In the Exclude area, Add the destination subnets or address object (of type IP Netmask) that you want the app to exclude. Excluded routes should be more specific than the included routes; otherwise, you may exclude more traffic than intended. You can exclude IPv6 or IPv4 subnets. The firewall supports up to 100 exclude access routes in a split tunnel gateway configuration. Unless combined with GlobalProtect app 4.1 and later releases, then up to 200 exclude access routes can be used.You cannot exclude access routes for endpoints running Android on Chromebooks. Only IPv4 routes are supported on Chromebooks.
Click OK to save the split tunnel configuration.Save the gateway configuration.- Click OK to save the settings.Commit the changes.
