According to Palo Alto Networks GlobalProtect documentation, split-tunnel exclusions can be defined by (1) destination domain names, (2) identified HTTP/HTTPS video-streaming applications, and (3) the local client application process name or executable. These methods allow traffic that matches any of those criteria to bypass the VPN tunnel while all other traffic remains in the secure tunnel. No mechanism exists to base split-tunneling on user/group, generic URL categories, or “source domain”.

A. Destination user/group – Split-tunneling decisions are not user- or group-aware; they are packet attribute–based.

B. URL Category – Only the special “video-streaming” category is supported, not arbitrary URL categories.

E. Source Domain – Decisions use destination domain (FQDN) the client contacts, not any “source” domain concept.

1. Palo Alto Networks

PAN-OS 10.2 GlobalProtect Administrator’s Guide

“About GlobalProtect Split Tunneling

” Table 1: Split-Tunnel Traffic Match Criteria (destination domain

video-streaming apps

client app process).

2. Palo Alto Networks

PAN-OS 10.2 GlobalProtect Administrator’s Guide

“Configure Split Tunnel Based on Domains

Applications

and HTTP/HTTPS Video Streaming

” Steps 2–4 (pp. 438-441).

3. Palo Alto Networks TechDocs

“Split Tunnel for GlobalProtect VPN” (doc ID GP-ST-10.2)

sections “Exclude by Destination Domain”

“Exclude Video Streaming Traffic”

“Exclude by Client Application”.