To enable split-tunneling by access route, destination domain, or application, the GlobalProtect gateway must be configured in Tunnel Mode. This mode establishes a secure VPN tunnel between the client and the gateway. Once Tunnel Mode is enabled on the gateway, you can then configure the specific split-tunneling rules in the GlobalProtect agent configuration. These rules dictate which traffic is sent through the VPN tunnel to the gateway for inspection and which traffic is excluded and sent directly to its destination. Without Tunnel Mode, the gateway cannot establish the necessary VPN connection to enforce these advanced traffic-steering policies.

A. No Direct Access to local networks: This is a client-side security setting that prevents access to the user's local LAN; it does not enable split-tunneling on the gateway.

C. IPsec mode: IPsec is a protocol choice for the tunnel, but the fundamental operational mode that enables tunneling is "Tunnel Mode." Split-tunneling works with both IPsec and SSL.

D. Satellite mode: This is not a standard GlobalProtect gateway configuration mode for enabling split-tunneling on a next-generation firewall.

1. Palo Alto Networks PAN-OS® Administrator's Guide 10.2: In the section on configuring a GlobalProtect gateway

the first step under the "General" tab is to enable Tunnel Mode. The documentation states

"To enable the gateway to establish a VPN tunnel

select Tunnel Mode." This is the prerequisite for all tunneling features. (Reference: PAN-OS Administrator's Guide 10.2 > GlobalProtect > Set Up the GlobalProtect Infrastructure > Configure the GlobalProtect Gateway > General Tab)

2. Palo Alto Networks PAN-OS® Administrator's Guide 10.2: The section on split-tunneling explains the configuration for including or excluding traffic by domain

application

and route. This entire feature set is predicated on the existence of a VPN tunnel

which is established by the gateway operating in Tunnel Mode. (Reference: PAN-OS Administrator's Guide 10.2 > GlobalProtect > Configure Split Tunneling for GlobalProtect)

3. Palo Alto Networks GlobalProtect™ Administrator's Guide 6.1: This guide explicitly links Tunnel Mode to subsequent configurations. "After you enable tunnel mode

you can configure tunnel settings..." The guide then details how to configure the agent

which includes the split-tunnel settings. (Reference: GlobalProtect Administrator's Guide 6.1 > Set Up the GlobalProtect Infrastructure > Configure the GlobalProtect Gateway)