Configure Split DNS for GlobalProtect App on iOS Endpoints

1. Ensure that the GlobalProtect portal is configured.

   To ensure that the GlobalProtect portal is configured, please confirm that the following default values of the app settings on the portal configurations are used:

   • Split-Tunnel Option - Network Traffic Only
   • Resolve All FQDNS Using the Tunnel DNS Server (iOS only) -Yes

2. Ensure that the GlobalProtect gateway is configured.
3. Configure split tunnel settings based on the DNS and Network Traffic for the GlobalProtect gateway. These settings are assigned to the virtual network adapter on the endpoint when the GlobalProtect app establishes a tunnel with the gateway.

   1. In the GlobalProtect Gateway Configuration dialog, select AgentClient Settings <client-setting-config> to select an existing client settings configuration or add a new one.
   2. Add the access route and domain that you want to route to GlobalProtect through the VPN connection. You can add up to 200 entries to GlobalProtect Gateways the list. You can add certain traffic and DNS to be included to the tunnel by specifying the destination subnets or address object and destination domain.

      You can configure the split tunnel functionality for the GlobalProtect app on iOS endpoints to specify how the DNS and network traffic should be handled through the tunnel:

      • Only certain traffic and certain DNS to be tunneled by GlobalProtect
      • Only certain traffic is included through the tunnel and exclude all DNS

      To include only certain traffic and certain DNS to be tunneled through the VPN connection

      1. Configure the access route-based Split Tunnel settings (Split TunnelAccess Route).
         In the Include area, add the destination subnets or address object (of type IP Netmask) to route only certain traffic destined for your LAN to GlobalProtect. You can include IPv6 or IPv4 subnets.

      2. Configure the domain-based Split Tunnel settings (Split TunnelDomain and Application ).
         In the Include area, add the private domain and SaaS or public cloud applications whose DNS traffic you want to route to GlobalProtect through the VPN connection using the destination domain and port. These domain rules only apply to DNS queries and not traffic. You can add up to 200 entries to GlobalProtect Gateways the list. For example, add *.google.com to allow all Google DNS queries to go through the VPN tunnel. You can use a wildcard character (*) at the beginning of the domain name. You cannot use the wildcard character (*) in the middle or end of the domain name.

      3. Configure Tunnel DNS server.
         • In the GlobalProtect Gateway Configuration dialog, select AgentClient Settings<client-setting-config>Network Services.
         • Enter the DNS Server.
         • (Optional)Enter the DNS Suffix.
         • Click OK.

      To include only certain traffic through tunnel and exclude all DNS

      1. Configure the access route-based Split Tunnel settings (Split TunnelAccess Route).
         In the Include area, add the destination subnets or address object (of type IP Netmask) to route only certain traffic destined for your LAN to GlobalProtect. You can include IPv6 or IPv4 subnets.

      2. To exclude all the DNS from going through the tunnel, leave the Include area empty (Split TunnelDomain and ApplicationInclude area). In this case, no DNS will be tunneled through the VPN connection

4. Click OK and commit your changes.
5. View the PanGPS.log to view the DNS Settings: For example,

   DNSSettings = {
           protocol = cleartext
           server = (
               x.x.x.x,
           )
           searchDomains = ()
           matchDomains = (
               paloaltonetworks.com,
               *.paloaltonetworks.com,
           )
           matchDomainsNoSearch = YES
       }
       IPv4Settings = {
           configMethod = manual
           addresses = (
               xxx.xx.xx.xx,
           )
           subnetMasks = (
               xxx.xxx.xxx.xxx,
           )
           includedRoutes = (
               {
                   destinationAddress = 0.0.0.0
                   destinationSubnetMask = 0.0.0.0
               },
               {
                   destinationAddress = x.x.x.x
                   destinationSubnetMask = xxx.xxx.xxx.xxx
               },
           )
           excludedRoutes = (
               {
                   destinationAddress = xxx.xx.xx.xxx
                   destinationSubnetMask = xxx.xxx.xxx.xxx
               },
           )
           overridePrimary = NO
       }
       IPv6Settings = {
           configMethod = manual
           addresses = (
               fc00::4f,
           )
           networkPrefixLengths = (
               128,
           )
           includedRoutes = (
               {
                   destinationAddress = ::
                   destinationNetworkPrefixLength = 0
               },
               {
                   destinationAddress = ::
                   destinationNetworkPrefixLength = 128
               },
           )

      Debug(13251): split-tunnel-option is network-traffic
   Debug(13262): Got split-tunnel-option-mobile is yes

   split-tunnel-option can have the values network-traffic or network traffic and DNS and split-tunnel-option-mobile can have the value yes or no.