This document describes how you can configure Global Protect when you need, sometimes full tunnel and sometimes split-tunnel usage.
GlobalProtect resource List provides additional information on configuring and troubleshooting GlobalProtect.
In this example we'll use IP interfaces as
ETH1 WAN : 88.88.88.88/32
ETH2 LAN : 192.168.0.1/24
Loopback : 1.1.1.1/32
VR: default
2 Tunnel interface with default VR and LAN zone selected
( You can create different zones for each tunnel interface, just you have to write security rule for them and Nat rule for the one used in a full tunnel )
1- Create a certificate
2- Create an Authentication Profile.(Here we use Local)
3- Create Local Groups for Split and Full Tunnel
4- Create users in these groups.
5- Create a loopback interface
6- Configure Global Protect Portal (You will only have one portal)
7- We need 2 different client configuration , one for split and one for full.
Choose user groups that we created on each config.Also One gateway should have a port.Here we used 444 but you can use any except for 443.
8- Create 2 seperate Global Protect Gateways, 1 with wan and 1 with loopback interface.Each has different ip pools.
9- Now we have to create NAT and security rules
Now when you connect to Global Protect Portal ip 88.88.88.88 using client software , each group will have different access
test1 user --------- Full Tunnel
test2 user --------- Split Tunnel