Split Tunneling in GlobalProtect determines which network traffic originating from the remote user's endpoint is sent through the secure VPN tunnel to the corporate network, and which traffic is sent directly to the internet via the user's local network connection.
This contrasts with Full Tunnel mode, where *all* traffic (corporate and internet-bound) from the endpoint is forced through the VPN tunnel.
The choice between split and full tunnel depends on balancing security requirements (inspecting all traffic) against performance and bandwidth considerations (allowing direct internet access).
| Consideration | Split Tunnel | Full Tunnel |
|---|---|---|
| Security Visibility & Control | Less visibility; only corporate-bound traffic inspected by firewall. Direct internet traffic bypasses corporate security. | More visibility; all traffic inspected. Consistent policy and threat prevention applied. |
| Bandwidth Consumption | Lower corporate bandwidth use; internet traffic uses user's local connection. | Higher corporate bandwidth use; all traffic traverses corporate links. |
| Performance (Internet/SaaS) | Potentially better performance for internet/SaaS apps via direct connection. | Performance may be impacted by latency through corporate network (hairpinning). |
| Local Network Access | Easy access to local resources (printers, etc.). | Local resource access may be blocked or require specific configuration. |
| Complexity | Requires careful definition of included/excluded routes/apps. Can be complex to manage precisely. | Simpler initial setup (all traffic goes through). |
| Compliance | May not meet requirements if all traffic must be logged/inspected. | Easier to meet strict compliance mandates requiring full traffic inspection. |
Split tunnel settings are configured within the Agent Client Settings of a GlobalProtect Gateway:
Network > GlobalProtect > Gateways > [Select Gateway] > Agent
tab >
Client Settings
sub-tab > Select/Add a Configuration >
Split Tunnel
tab.
10.0.0.0/8
,
172.16.32.0/24
).
# Example: Access Route for Internal Networks
10.10.0.0/16
192.168.50.0/24
# Traffic to these destinations goes via VPN.
# Traffic to Google DNS (8.8.8.8) goes direct to internet.
These provide more granular control, overriding the Access Route logic for specific domains or applications.
*.office365.com
,
zoom.us
) or select Applications/App Filters (e.g.,
microsoft-base
,
slack-base
).
# Example: Exclude O365 Domains (even if 10.x.x.x is an Access Route)
Exclude Domain/App: *.office.com, *.sharepoint.com, office365-base
When the GlobalProtect agent receives the split tunnel configuration from the Gateway:
graph TD
A[User Traffic] --> B{GP Agent Intercepts};
B --> C{Check Split Tunnel Rules};
C -- Dest Matches Access Route (10.0.0.0/8)? --> D[Route via VPN Tunnel Interface];
C -- Dest Does NOT Match Access Route? --> E{Check Domain/App Includes};
E -- Matches Include Rule? --> D;
E -- No Match --> F{Check Domain/App/Video Excludes};
F -- Matches Exclude Rule? --> G[Route via Physical Adapter Interface];
F -- No Match --> G;
%% Default for non-included/non-excluded traffic in split mode
D --> H((Corporate Firewall));
G --> I((Internet / Local Network));
style D fill:#d5f5e3,stroke:#58d68d,stroke-width:1px
style G fill:#fdebd0,stroke:#f5b041,stroke-width:1px
Simplified Client-Side Routing Decision Logic.
0.0.0.0/0
with specific exclusions) can be confusing and functionally similar to defining exclusions from a full tunnel. It's often clearer to define only the internal networks needed in the Access Route include list.
0.0.0.0/0
.
For the PCNSE exam, regarding Split Tunneling:
1. What does "Split Tunnel" mode in GlobalProtect allow a client to do?
2. Where are Split Tunnel settings primarily configured in PAN-OS?
3. What does the "Access Routes" list within the Split Tunnel configuration define?
4. If the "Access Routes" list in the Split Tunnel configuration is left empty, what mode does GlobalProtect typically operate in?
5. An administrator wants internal traffic (10.0.0.0/8) to go through the VPN, but wants Microsoft Office 365 traffic to go directly to the internet for better performance. How should this be configured?
6. What is a significant security consideration when implementing split tunneling?
7. How does the GlobalProtect agent modify the endpoint's networking when split tunneling via Access Routes is configured?
8. The "Exclude Video Streaming Applications" checkbox in the Split Tunnel configuration primarily helps achieve which goal?
9. What potential issue needs careful consideration when implementing split tunneling, especially regarding name resolution?
10. An administrator defines 192.168.1.0/24 in the Access Routes (Include List) and adds `*.google.com` to the Domain Exclude List. What happens to traffic destined for a Google server with IP 172.217.160.142?