GlobalProtect Split Tunneling Deep Dive

What is Split Tunneling?

Split Tunneling in Palo Alto Networks GlobalProtect is a configuration method that precisely controls which network traffic originating from a remote user's endpoint is sent through the secure VPN tunnel to the corporate network, and which traffic is allowed to go directly to its destination (like the internet) using the user's local network interface and internet connection.

This contrasts fundamentally with the alternative mode, **Full Tunnel**, where *all* network traffic generated by the endpoint – whether destined for internal corporate resources or public internet sites – is forcibly routed through the VPN tunnel. This ensures all traffic is inspected by the corporate firewall.

Conceptual difference between Split Tunnel and Full Tunnel traffic flow.

The decision to implement Split Tunneling involves a trade-off, primarily balancing the desire for comprehensive security inspection against user experience, performance, and corporate bandwidth utilization.

Use Cases & Comparison: Split vs. Full Tunnel

Why Choose One Over the Other?

The choice between Split Tunnel and Full Tunnel depends on your organization's priorities:

Typical Use Cases for Split Tunneling:

• Optimizing SaaS Performance: Allowing direct access to trusted, high-bandwidth SaaS applications like Microsoft 365, Google Workspace, Salesforce, Zoom, Microsoft Teams to improve user experience and reduce load on the corporate internet circuit.
• Reducing Bandwidth Load: Preventing general web browsing, video/music streaming, or large software updates from consuming expensive corporate bandwidth.
• Supporting Local Resources: Allowing users to easily access their home printers or other devices on their local network without disconnecting the VPN.
• Guest or Contractor Access: Providing limited VPN access strictly to necessary internal resources while allowing guests/contractors to use their own internet for everything else.

Licensing Requirements

Understanding the licensing implications is important when planning your split tunneling strategy:

• Basic Split Tunneling (Access Routes - IP Based): Configuring split tunneling using only the Access Routes (Include List) based on destination IP addresses or subnets is a core GlobalProtect feature. It does not require any additional licenses beyond the standard GlobalProtect Gateway license (which itself is often included with the platform or requires a basic GlobalProtect subscription).
• Domain/Application Based Split Tunneling:
  • Configuring split tunneling using Include/Exclude Domains (FQDNs) or, more significantly, using Include/Exclude Applications/App Filters relies on the firewall's Application Identification (App-ID) engine.
  • Therefore, this method requires an active App-ID subscription (which is typically part of the Threat Prevention subscription bundle or available standalone in some cases).
  • Without a valid App-ID subscription and up-to-date content versions, the firewall may not accurately identify the applications, rendering Application-based split tunneling ineffective or unreliable.
• Exclude Video Streaming Applications:
  • This specific checkbox also leverages App-ID to identify common video streaming applications.
  • Therefore, it also requires an active App-ID subscription and relevant content updates to function correctly.

Configuration Methods

Configuration Location

Split tunnel settings are an integral part of the client configuration pushed down from a GlobalProtect Gateway. You configure these settings within a specific **Agent Configuration** block defined on the Gateway.

GUI Path:

1. Navigate to Network > GlobalProtect > Gateways .
2. Select the desired Gateway object and click to edit it.
3. Go to the Agent tab.
4. Inside the Agent tab, select the Client Settings sub-tab.
5. Click Add to create a new agent configuration block, or select an existing one to modify it. (Remember, you can have multiple agent configuration blocks matched by OS/User/HIP).
6. Within the agent configuration window, navigate to the Split Tunnel tab.

This is where you define which traffic goes through the tunnel using the methods described in the following sections.

Method 1: Access Routes (Include List - Network Layer)

This is the most fundamental and common method for defining split tunnels. It operates at the network layer (IP addresses).

• Purpose: To explicitly define which destination IP networks (subnets) should have their traffic routed **through** the GlobalProtect VPN tunnel.
• How it Works: You create a list of IPv4 and/or IPv6 addresses or network ranges (using CIDR notation). When the GlobalProtect agent connects and receives this configuration, it adds specific routes for these networks to the endpoint's routing table, pointing them towards the virtual network adapter created by GlobalProtect.
• Traffic Flow: Any traffic destined for an IP address that falls within one of the subnets listed in the "Access Routes" (Include List) will be sent through the VPN tunnel. Traffic destined for any IP address *not* covered by this list will use the endpoint's regular network interface and default gateway (typically going directly to the local network or internet).
• Configuration: In the "Split Tunnel" tab, under the "Access Route" section, click "Add" and enter the required IP addresses or CIDR ranges (e.g., 10.0.0.0/8 , 192.168.1.0/24 , 172.16.32.10/32 , 2001:db8:1::/48 ).

Method 2: Domain/Application Excludes & Includes (Layer 7)

These methods provide more granular control, operating based on destination domain names (FQDNs) or identified applications (App-ID), allowing overrides to the basic Access Route logic.

Exclude Domains/Applications from Tunnel

• Purpose: To specify domains or applications whose traffic should **bypass** the VPN tunnel and go directly via the user's local network, *even if the destination IP address would normally match an included Access Route*.
• How it Works: The GlobalProtect agent monitors DNS requests and network traffic. If traffic matches an excluded domain pattern (e.g., *.microsoft.com ) or is identified as belonging to an excluded application (via deep packet inspection referencing App-ID signatures learned from the firewall), the agent routes it directly, ignoring Access Route rules for that specific flow.
• Configuration:
  • Exclude Domain: Add FQDNs. Wildcards (*) are supported at the beginning (e.g., *.salesforce.com ).
  • Exclude Application/Filter: Select predefined Applications (e.g., `zoom-meetings`) or Application Filters (e.g., `saas-collaboration`) from the firewall's App-ID database.
• Common Use Case: Improving performance for trusted, high-bandwidth SaaS applications. By excluding Office 365, Zoom, Teams, etc., users get direct, lower-latency access, reducing load on the corporate VPN and internet links.

Include Domains/Applications in Tunnel

• Purpose: To specify domains or applications whose traffic **must** go through the VPN tunnel, *even if the destination IP address does NOT match an included Access Route*.
• How it Works: If traffic matches an included domain or application, the agent forces it into the tunnel, overriding the normal behavior where non-Access-Route traffic would go direct.
• Configuration: Similar to excludes, add FQDNs or select Applications/Filters in the "Include" section.
• Less Common Use Case: Primarily used when the default mode is split tunnel (only specific Access Routes defined), but you need to ensure certain critical cloud services (perhaps a specific corporate SaaS app with public IPs) are always accessed via the corporate network for inspection or source IP requirements, regardless of their destination IP not being in the Access Route list.

Method 3: Exclude Video Streaming Applications

This is a simplified convenience feature leveraging App-ID.

• Purpose: To easily prevent high-bandwidth consumer video streaming traffic from congesting the VPN tunnel and corporate internet links.
• How it Works: When checked, the firewall provides the GlobalProtect agent with a list of applications categorized by Palo Alto Networks as common video streaming services (e.g., YouTube, Netflix, Hulu, Vimeo). The agent then routes traffic identified as belonging to these applications directly via the local network, similar to a specific Application Exclude rule.
• Configuration: Simply check the box labeled **"Exclude Video Streaming Applications"** in the Split Tunnel tab.
• Benefit: Avoids the need to manually list dozens of video streaming domains or App-IDs in the "Exclude Domain/Application" list. The underlying application list is maintained by Palo Alto Networks through App-ID content updates.

Rule Precedence: How Decisions Are Made

When multiple split tunneling methods are configured, the GlobalProtect agent follows a specific order of operations to decide where to route traffic. Understanding this precedence is key for complex configurations:

Simplified Split Tunnel Decision Logic Flowchart.

The general order of precedence is roughly:

1. Domain/Application Exclusions & Video Exclusions: If traffic matches a specific domain/application exclusion rule OR the "Exclude Video Streaming" rule (if enabled), it is sent directly via the local network interface, **regardless** of any Access Route or Include rules. Exclusions take highest priority to bypass the tunnel.
2. Domain/Application Inclusions: If traffic matches a specific domain/application inclusion rule, it is sent through the VPN tunnel, **regardless** of whether its destination IP matches an Access Route or not.
3. Access Route (Include List) Match: If traffic hasn't matched an explicit include/exclude rule above, the agent checks if the destination IP address matches any network listed in the Access Routes. If it matches, the traffic is sent through the VPN tunnel.
4. Default Action (No Match Above): If traffic hasn't matched any exclude, include, or Access Route rule:
   • If the Access Route list **is defined (not empty)**, the default action is to send the traffic via the **local network interface** (standard split tunnel behavior).
   • If the Access Route list **is empty**, the default action is to send the traffic via the **VPN tunnel** (Full Tunnel behavior).

Client-Side Behavior & DNS

How Split Tunneling Works on the Client

When the GlobalProtect agent connects and receives its configuration (including split tunnel settings) from the Gateway, it performs several actions on the endpoint OS:

1. Virtual Network Adapter: A virtual network adapter (e.g., `PanGpa`, `gpvpn`) is created and activated. This adapter gets an IP address assigned from the IP Pool defined in the matched Agent Configuration.
2. Routing Table Modification: This is the core of split tunneling.
   • Access Routes Defined (Split Tunnel Mode):
     • The agent adds **specific routes** to the endpoint's OS routing table for each network listed in the "Access Route" (Include List).
     • These specific routes have the GlobalProtect virtual adapter's gateway as their next hop.
     • The endpoint's **default route** (0.0.0.0/0 or ::/0) typically remains unchanged, pointing to the user's physical network adapter's gateway (e.g., their home router).
   • Access Routes Empty (Full Tunnel Mode):
     • The agent typically **changes the endpoint's default route** (0.0.0.0/0 and/or ::/0) to point to the GlobalProtect virtual adapter's gateway.
     • This forces all traffic not matching a more specific local route to go through the VPN tunnel. More specific routes for the local subnet might still exist to allow local network communication if configured.
3. DNS Configuration: The agent configures the endpoint's DNS settings (specifically for the virtual adapter or system-wide depending on OS and configuration) to use the DNS servers specified in the matched Agent Configuration.
4. Traffic Interception/Steering: The GlobalProtect agent service actively monitors network traffic initiation (e.g., socket calls, DNS lookups). Based on the destination IP, domain name, or application identification, and comparing against the configured split tunnel rules (Access Routes, Includes, Excludes, Video), it directs the traffic to the appropriate network interface (Virtual VPN adapter or Physical local adapter).

Sequence diagram illustrating GP Agent's role in traffic steering based on rules.

This modification of the routing table and active traffic steering by the agent service are how split tunneling is implemented at the endpoint level.

DNS Considerations (Split DNS)

DNS resolution is a critical, and often tricky, aspect of split tunneling. Clients need to be able to resolve both internal corporate hostnames (for resources accessed via the tunnel) and external public hostnames (for resources accessed directly).

The Challenge (Split DNS):

• Internal resources often rely on internal DNS servers (e.g., Active Directory DNS) which are only reachable via the VPN tunnel.
• External resources rely on public DNS servers or the user's local ISP DNS servers.
• The endpoint needs a way to direct DNS queries appropriately based on the hostname being queried.

Common Approaches & Configuration:

1. Use Internal DNS Servers Exclusively (Simplest if they forward):
   • Configure the GlobalProtect Gateway Agent settings to push **only** your internal corporate DNS servers to the client.
   • **Requirement:** Your internal DNS servers must be configured to forward queries for external domains they don't recognize to public DNS resolvers (e.g., Google DNS, Cloudflare DNS, or ISP DNS).
   • **Pros:** Simple client configuration. All DNS queries go through the tunnel initially (which might be desired for logging/security).
   • **Cons:** Relies entirely on internal DNS availability and correct forwarding. Can add latency to external DNS resolution as it traverses the tunnel. Might fail if internal DNS servers go down.
2. Use Internal DNS Servers + DNS Suffix Search List:
   • Push internal DNS servers via GlobalProtect.
   • Configure a **DNS Suffix Search List** in the Gateway Agent settings (e.g., corp.example.com ).
   • The client OS will try appending these suffixes to single-label hostnames (e.g., query for `fileserver` becomes `fileserver.corp.example.com`) before querying the assigned DNS servers.
   • Still relies on internal DNS forwarding for external names.
3. "Split DNS" Configuration (More Complex, OS Dependent):
   • This involves configuring the client OS to use specific DNS servers for specific domains, often through features like Windows NRPT (Name Resolution Policy Table) or similar mechanisms pushed via endpoint management, or sometimes approximated by careful DNS suffix configuration.
   • GlobalProtect itself doesn't directly configure complex OS-level split DNS policies. It primarily pushes the main DNS servers for the VPN interface.
   • You might push internal DNS via GP, and users rely on their physical adapter's DNS settings for direct traffic, but the OS needs to be smart enough to choose the right interface/server for the query (which isn't always guaranteed or easily configured just via GP).
4. Using Public DNS Servers Exclusively (Rare for Split Tunnel):
   • Push public DNS servers (e.g., 8.8.8.8) via GlobalProtect.
   • **Requirement:** Internal hostnames must somehow be resolvable publicly (e.g., split-horizon DNS setup externally) or users must use FQDNs that resolve publicly, or rely solely on IP addresses for internal access.
   • **Pros:** External resolution is fast.
   • **Cons:** Usually breaks internal hostname resolution unless specific external configurations are in place. Generally not suitable if internal name resolution is needed.

Conceptual illustration of DNS resolution paths in different scenarios.

Best Practices & Exam Focus

Gotchas and Caveats

While split tunneling offers benefits, it introduces complexities and potential risks:

• Security Risk of Direct Access: This is the most significant caveat. Traffic bypassing the tunnel (sent direct) also bypasses all corporate security inspection layers (Firewall Policy, Threat Prevention, WildFire, URL Filtering, DLP, etc.). If an endpoint gets compromised via a malicious site accessed directly, it could potentially pivot to attack resources accessible via the tunnel. Evaluate this risk carefully.
• DNS Resolution Complexity: As discussed previously, ensuring reliable DNS resolution for both internal and external resources ("Split DNS") can be challenging and is a common source of issues.
• Complexity of Exclusions/Inclusions: Maintaining accurate lists of domains and especially applications for include/exclude rules can be difficult. SaaS applications frequently change their underlying IP addresses and domains, and App-ID signatures need to be kept up-to-date. Over-reliance on highly granular excludes/includes can increase management overhead.
• Access Route Specificity: Using overly broad Access Routes (like including `0.0.0.0/0` and then trying to exclude many specific public ranges) is generally discouraged. It becomes functionally similar to configuring exclusions from a full tunnel but is harder to reason about. Best practice is usually to include only the necessary internal ranges.
• Order of Operations/Precedence: Complex configurations combining Access Routes with multiple includes and excludes require a clear understanding of the precedence rules (Excludes > Includes > Access Routes > Default) to predict traffic flow accurately.
• IPv6 Considerations: If your internal network or target resources use IPv6, ensure you configure both IPv4 and IPv6 Access Routes and DNS settings appropriately. Failure to include IPv6 routes when needed can break access for dual-stacked clients.
• Application Identification Latency/Accuracy: Application-based split tunneling relies on App-ID. There might be a slight delay before an application flow is identified, and inaccurate identification (due to encryption, obfuscation, or outdated signatures) can lead to incorrect routing decisions. IP-based Access Routes are generally more deterministic.
• Local Network Conflicts: If the user's local network subnet (e.g., home network using 192.168.1.0/24) overlaps with a subnet defined in the Access Route list, unpredictable routing or connectivity issues can occur. GlobalProtect has settings (like "No Direct Access to Local Network" - though this affects all local access) that can sometimes mitigate this, but it's best to avoid common home network ranges in corporate Access Route lists if possible.
• Troubleshooting Difficulty: Diagnosing split tunnel issues can be harder than full tunnel problems, as you need to consider both the VPN path/policies AND the local network path/potential blocks.

Best Practices for Split Tunneling

To implement split tunneling effectively and minimize risks:

• Default to Full Tunnel (Security First): If security visibility and control are paramount, and bandwidth/latency are acceptable, **start with Full Tunnel mode**. Only implement split tunneling if there is a clear, justifiable need based on performance, bandwidth constraints, or specific application requirements.
• Be Specific with Access Routes (Include List): When using IP-based split tunneling, precisely define only the **internal corporate subnets** that users genuinely need to access via the VPN in the Access Route list. Avoid overly broad ranges or including `0.0.0.0/0`.
• Use Domain/App Exclusions Strategically: Leverage Domain/Application exclusions primarily for **trusted, well-known, high-bandwidth SaaS applications** (e.g., Microsoft 365, Teams, Zoom, Salesforce) where direct access significantly improves user experience and the associated risk is understood and accepted.
• Prefer App Filters over Individual Apps/Domains (Where Possible): Using curated Application Filters (like `microsoft-office-365`, `saas-collaboration`) can be easier to manage than listing dozens of individual applications or domains, as Palo Alto Networks maintains the filter definitions.
• Minimize Use of Includes: Domain/Application *Inclusions* should be used sparingly, only when necessary to force specific public-facing services through the tunnel that wouldn't be covered by Access Routes.
• Simplify when Possible: Avoid creating excessively complex rules with numerous overlapping includes and excludes if a simpler Access Route definition or a slightly broader exclusion can achieve the desired outcome with less management overhead.
• Manage DNS Carefully: This is critical. Ensure the DNS servers assigned to VPN clients can resolve internal names AND reliably forward external queries. Test DNS resolution thoroughly for both internal and external domains after implementing split tunnel.
• Combine with Endpoint Security: Since split tunneling allows direct internet access, robust endpoint security (EDR, host firewall, up-to-date patching, user awareness training) becomes even more critical to protect the endpoint from threats encountered via the direct path.
• Document Thoroughly: Clearly document the split tunnel strategy, the rationale behind it, the specific networks included via Access Routes, and any Domain/Application/Video exclusions or inclusions.
• Test, Test, Test: Rigorously test all scenarios:
  • Access to resources included in the tunnel (by IP and hostname).
  • Access to resources excluded from the tunnel (verify they go direct).
  • Access to general internet resources (verify they go direct).
  • DNS resolution for internal and external names.
  • Access to local network resources (if intended).
• Monitor and Review: Periodically review split tunnel configurations, especially domain/app lists, to ensure they are still accurate and necessary. Monitor bandwidth usage and user feedback.

PCNSE Exam Focus for Split Tunneling

Based on the PCNSE exam objectives and common question patterns, here's what you should focus on regarding GlobalProtect Split Tunneling:

• Core Concepts:
  • Definition: Clearly understand what split tunneling is and how it differs fundamentally from full tunnel mode.
  • Purpose/Trade-offs: Know the main reasons for using split tunnel (performance, bandwidth) versus full tunnel (security, control) and the inherent risks/benefits of each.
• Configuration Location:
  • Be able to navigate to the correct location in the PAN-OS GUI: Network > GlobalProtect > Gateways > [Gateway Name] > Agent tab > Client Settings > [Configuration Name] > Split Tunnel tab .
• Configuration Methods:
  • Access Routes: Understand this is the primary IP-based method. Know it's an *include* list (defines what goes *in* the tunnel). Crucially, know that an **empty Access Route list means Full Tunnel**.
  • Domain/Application Excludes: Understand their purpose (bypass tunnel for performance, SaaS optimization) and that they override Access Routes. Know that they rely on App-ID.
  • Domain/Application Includes: Understand their purpose (force into tunnel when not matching Access Routes) and that they rely on App-ID. Know this is less common than excludes.
  • Exclude Video Streaming: Know what this checkbox does and that it relies on App-ID.
• Licensing:
  • Know that basic Access Route split tunneling doesn't require extra licenses, but Domain/Application/Video split tunneling **requires an active App-ID subscription**.
• Client Behavior:
  • Have a conceptual understanding of how the agent modifies the endpoint's routing table (adding specific routes for Access Routes, changing default route for full tunnel).
• DNS:
  • Recognize the importance of DNS in split tunnel scenarios ("Split DNS").
  • Understand the common configuration approach (pushing internal DNS servers that can forward external queries).
  • Be able to identify DNS issues as a likely cause if users can access internal IPs but not hostnames.
• Security Implications:
  • Be acutely aware that traffic excluded from the tunnel **bypasses corporate security inspection**.
• Troubleshooting:
  • Know where to look for relevant logs (System logs for GP connection/config, Traffic logs for tunneled traffic, potentially endpoint logs).
  • Common issues: Incorrect Access Routes, DNS misconfiguration, App-ID issues (for domain/app tunneling), rule precedence misunderstandings.
• Scenario Application:
  • Be prepared for questions that describe a scenario (e.g., "Optimize O365 traffic", "Allow access only to 10.x networks") and ask for the correct split tunnel configuration method.

GlobalProtect Split Tunneling - Interactive Quiz

Test your knowledge on GlobalProtect Split Tunnel configuration and concepts.