GlobalProtect users cannot access excluded domains when split tunnel is configured

• GlobalProtect has been deployed with split tunnelling traffic to exclude a list of domains.
• The GlobalProtect logs shows the excluded domains are correctly excluded.
• Few of the users cannot reached these excluded domains.
• On browser Google Chrome, the error displayed is "ERR_ADDRESS_INVALID".
• When GlobalProtect is disabled, users can access to the excluded domains.

• Palo Alto Firewalls
• Supported PAN-OS
• GlobalProtect (GP) App
• Split-tunnel configured with domain exclusion

• The client is located in a IPv6 native network.
• DNS Server is in the IPv4 Network.
• The client is trying to reach the IPv4 DNS Server over the IPv6 network.
• To check, disconnect the GP App on client and ping one excluded domain to see the IP contacted is IPv4 or IPv6 format.
  
  
  
  
  

1. The resolution is to enable the Split DNS feature.
2. When Split tunnel feature is enabled, the excluded domains / URLs are resolved using the public DNS server.
   
   

IPv4 format: 32 bits represented by 4 decimal number separated by dots.
IPv6 format: 128 bits represented by up to 8 hexadecimal numbers separated by colons.