Internal Host Detection configured but Global Protect Users still connecting to External Gateway

• Internal Host Detection configured.
• Users connecting from the inside network.
• Connection succeeds to external gateway instead of internal.
• Looking at the clients Global Protect PanGPS.log shows "DnsQuery returns 9003"

13:33:48:529 No <host> or <ip-address> in internal-host-detection
13:33:48:599 IP 10.10.10.10 
13:33:48:599 host 10.10.10.10 
13:33:49:601 DnsQuery returns 9003
13:33:49:601 Resolved 254.10.10.10.in-addr.arpa for internal host detection with return value 9003
13:33:49:601 NetworkDiscoverThread: network type is external.
13:33:49:601 NetworkDiscoverThread: Discover external network.

• Prisma Access (Panorama Managed)
• Global Protect Configured.

• Error Code 9003 means 'DNS name does not exist' (See Additional Info for article on DNS Response)
• The IP address configured for Internal Host Detection in GlobalProtect client configuration does not match to the DNS name specified.

1. Log into Panorama
2. Click on GUI: Panorama > Cloud Services > Configuration
3. Click Mobile Users tab
4. Under Onboarding select the Configuration you wish to configure
5. General > Internal Host Detection (Click the Checkbox to enable)
   1. Enter the IP Address of a host that can be reached from the internal network only
   2. Enter the DNS Hostname for the IP address you entered.
6. Click OK
7. Commit and Push to Prisma