![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(112.00000000000001, 1%, 20%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EE%3C/text%3E%3C/svg%3E)
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(275.2, 16%, 36%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EV%3C/text%3E%3C/svg%3E)
Hi Ezreal,
To isolate your client traffic routing rules and stop this infinite interception cycle, right-click the Global Secure Access client icon in your Windows system tray and select Advanced Diagnostics. Switch to the Rules tab to view your active traffic routing logic, you can verify you have found the correct rule when you see your internal web application's destination FQDN explicitly listed under the active routing rules. Next, open your browser settings and completely disable Secure DNS (or set the BuiltInDnsClientEnabled registry policy to 0) to stop encrypted DNS requests from bypassing the client. You can verify this step is successful if DNS requests for your internal apps begin appearing normally in the GSA Advanced Diagnostics traffic logs. If you are running a local web proxy, configure its PAC file or exclusion list to explicitly bypass Global Secure Access traffic, which you can confirm is working when the immediate timeout errors cease. Finally, because the GSA client currently only tunnels IPv4 traffic, open your Windows Network Adapter properties and uncheck Internet Protocol Version 6 (TCP/IPv6). You will know the IPv6 conflict is resolved when your internal web applications successfully load through the IPv4 tunnel without falling back into a continuous loopback cycle.
VPHAN