Hello friends, welcome back—Day 48 of my PCNSA series. In this video I explained one of the most important GlobalProtect concepts you will face in real projects: split tunnel vs full tunnel, and how exactly it works when the user connects from home to the portal and then builds the tunnel to the gateway. I first covered the concept using a simple topology, then I moved to the lab so you can clearly see how the client routing changes based on what we configure on the gateway. In full tunnel, I showed that all traffic (including internet traffic) is forced into the VPN tunnel, and the gateway/firewall takes the decision based on policy—so you get maximum control. But the disadvantage is bandwidth: if you have 500 or 1000 users, you need strong bandwidth and capacity because everything is hairpinned through the gateway. In split tunnel, I configured an include network (example: 192.168.20.0/24) so only that destination traffic goes through the tunnel, and the rest goes directly to the user’s local internet via the NIC—less control, but you can support more users with less bandwidth. In the lab, I also showed you where to verify it on the client side (GlobalProtect troubleshooting > advanced > network configuration > routing table) and where to configure it on the gateway (Client Settings > GP Client > Split Tunnel).