After configuring domain-based split tunnel for zoom.us, how is expected behavior on the client machine confirmed?

GlobalProtect implements domain-based split tunneling by resolving the specified domain (e.g., zoom.us) to its corresponding IP addresses. The GlobalProtect agent then dynamically adds specific host routes for these IP addresses into the client machine's operating system routing table. These routes direct traffic destined for the excluded domain's IPs to the client's local physical gateway, bypassing the VPN tunnel. Therefore, the most direct and accurate method to confirm that the split tunnel is functioning as expected is to inspect the client's routing table for the presence of these specific routes pointing to the local gateway.

B. Enable dump level logs on GlobalProtect Application. This is an advanced troubleshooting step for diagnosing failures, not a standard procedure for confirming normal, expected behavior.
C. Verify zoom.us is resolved by the tunnel assigned DNS server. This is the opposite of the expected behavior. For an excluded domain, DNS resolution should use the client's local DNS servers to ensure traffic is routed locally.
D. Ping zoom.us from the CLI. A successful ping only confirms network reachability to the destination; it does not provide information about the path the traffic took (i.e., via the tunnel or the local network). ---

1. Palo Alto Networks. (2023). GlobalProtect Administrator's Guide PAN-OS 11.0. Section: "Configure Split Tunneling Based on the Domain Name".

This section details the mechanism: "When the GlobalProtect app resolves a domain name in the split tunnel exclude list, it adds the IP address to a list and routes all traffic for that IP address to the local network." The method for routing traffic is by manipulating the client's OS routing table.

2. Palo Alto Networks. (2023). GlobalProtect Administrator's Guide PAN-OS 11.0. Section: "Split Tunneling on the GlobalProtect App".

This document explains that for excluded domains, the app ensures traffic is sent to the local network. Verifying the routing table is the standard OS-level method to confirm this traffic steering is in place. For example, on Windows, the route print command would show specific /32 routes for the resolved IPs of zoom.us pointing to the local gateway.

3. Palo Alto Networks. (2023). GlobalProtect Administrator's Guide PAN-OS 11.0. Section: "Troubleshoot GlobalProtect Connections".

Within troubleshooting scenarios for network access, a primary step is to verify the client's network configuration, which includes the routing table (route print or netstat -rn). This confirms whether the GlobalProtect agent has correctly installed the necessary routes to enforce the configured policy, including split tunnels.