Ivanti Pulse Secure often blocks access to internal network resources due to split tunneling configurations, incorrect DNS settings, or Windows 11 interface metric conflicts. To restore connectivity, you must verify that the client is not routing all traffic through the VPN while lacking routes for local subnets, ensure DNS suffixes are correctly appended, and adjust your network adapter metrics to prioritize the correct interface for local traffic.
Understanding Split Tunneling and Routing Policies
The most common reason users cannot see their internal network after connecting to Ivanti Pulse Secure is a misalignment between the client configuration and the server-side routing policy. By default, many corporate VPN deployments use split tunneling, which allows local LAN traffic to bypass the VPN while sending only specific corporate subnets through the encrypted tunnel. If your local subnet is not included in the "Routes" list provided by the server, Windows will attempt to reach those devices via your primary internet connection, which fails because those devices are not publicly routable.
It is crucial to understand that the decision to route all traffic or split it is primarily controlled by the VPN server administrator, not the client application. You cannot simply toggle a switch on your laptop to force all traffic through the VPN if the server has not authorized those routes. However, you can check what routes have been pushed to your machine to diagnose why specific internal sites or printers are unreachable.
When the connection is established, Ivanti Pulse Secure installs virtual network adapters. These adapters receive IP addresses and routing tables from the authentication server. If the server does not push a route for your local office subnet (for example,
192.168.1.0/24), Windows will ignore the local gateway for those addresses. Instead, it will look at its default route table and send the packet out through your Wi-Fi or Ethernet card destined for your home router. Since your home router does not know how to reach the office's private IP space, the connection times out.
To verify this, you should examine the active routes on your system. Open a command prompt and run
route print. Look for entries that match your local subnet. If they are missing, or if they point to an incorrect gateway, the issue lies with the server configuration. In this case, you must contact your IT support team to request that your specific subnet be added to the allowed routes for your user profile. Do not attempt to manually add static routes in Windows unless explicitly instructed by your network administrator, as this can create persistent conflicts when you disconnect from the VPN.
For more details on how remote devices connect over VPNs, see
Connecting Remote Local Network Devices Connected via VPN on Windows 11.
DNS Resolution Conflicts
Even if you can ping an internal server by its IP address, you may still be unable to browse internal websites or access shared drives by name. This is almost always a DNS resolution failure. When connected to the corporate VPN, your computer receives new DNS server addresses from the Ivanti Pulse Secure server. These servers are typically internal-only resolvers that know how to translate internal hostnames like
intranet.corp.local into private IP addresses.
Windows 11 manages DNS suffixes to determine which DNS server to query first. If the DNS suffix search list is not configured correctly, your operating system might query your public ISP DNS servers instead of the internal corporate DNS servers. Public DNS servers do not have records for your company's internal resources, resulting in "Server Not Found" errors despite a successful VPN connection.
You can check your current DNS configuration by running
ipconfig /all in the command line. Look for the section corresponding to your Ivanti virtual adapter. Ensure that the "DNS Servers" listed there are internal IPs (usually starting with
10.x.x.x or
192.168.x.x) and not your public gateway. Additionally, check the "DNS Suffix Search List". It should include your company's domain suffix (e.g.,
corp.company.com). If this list is empty, Windows will not append the suffix when you type a short hostname, causing resolution failures.
If the DNS settings appear correct but resolution still fails, try flushing the DNS cache by running
ipconfig /flushdns. Sometimes, stale records from before the VPN connection were established can cause lingering issues. For a deeper dive into DNS troubleshooting with VPNs, refer to
Windows 11 DNS Resolution Not Working with Any VPN Service.
Interface Metric and Routing Conflicts in Windows 11
Windows 11 uses a metric system to decide which network interface to use when multiple connections are active. The interface with the lowest metric value is preferred. When you connect to Ivanti Pulse Secure, the virtual adapter is created with a default metric. Often, this metric is higher than your physical Wi-Fi or Ethernet adapter, meaning Windows prefers the physical connection for general traffic.
However, if you are trying to access a resource that falls outside the specific subnets routed by the VPN, Windows will use the physical adapter. If the physical adapter's gateway does not know how to reach the target, the connection fails. Conversely, if the VPN adapter's metric is too low, it might steal traffic intended for the local network, causing general internet browsing to fail or become slow if the VPN link is congested.
You can view and adjust these metrics by opening the Network Connections control panel, right-clicking your active adapters, selecting Properties, then Internet Protocol Version 4 (TCP/IPv4), and clicking Advanced. Here you can uncheck "Automatic metric" and set a custom value. Generally, you want the physical adapter to have a lower metric for local traffic, but this requires careful tuning based on your specific network topology. Incorrectly adjusting these values can lead to intermittent connectivity issues.
Another related issue involves the "Binding Order" of network adapters. Windows processes adapters in a specific order defined in the Advanced TCP/IP Settings. If the Ivanti virtual adapter is listed above your physical adapter, it may intercept traffic prematurely. Reordering these bindings can sometimes resolve obscure routing loops. For more information on how Windows handles traffic binding, check
Windows 11: Why is traffic bound to one interface is sent to another?.
Troubleshooting Steps for Immediate Relief
Before contacting IT support, perform these basic diagnostic steps to isolate the problem. First, verify that you can ping the DNS server assigned by the VPN. If you cannot ping the DNS server, the VPN tunnel itself is likely broken or blocked by a firewall. Second, try accessing an internal resource using its full FQDN (Fully Qualified Domain Name) rather than just the short name. If the FQDN works but the short name does not, the issue is definitely DNS suffix-related.
Third, disconnect and reconnect the Ivanti Pulse Secure client. This forces the re-download of routing tables and DNS settings from the server. Sometimes, transient glitches in the push configuration can be resolved by a simple reconnect. Finally, ensure that your Windows Firewall or third-party antivirus software is not blocking the Ivanti client's virtual adapter. Some security suites treat unknown virtual interfaces as threats and drop all inbound traffic, effectively isolating you from the internal network even when connected.
Frequently Asked Questions
Can I force all traffic through the Ivanti VPN?
No, you cannot force all traffic through the VPN if the server administrator has not enabled this policy. This setting is controlled server-side to manage bandwidth and security. Attempting to manually route all traffic via Windows settings can break your internet access and violate company security policies.
Why can I ping internal IPs but not browse internal websites?
This indicates a DNS resolution problem. Your routing is correct, allowing packets to reach the internal servers, but your computer does not know the IP address associated with the website name. Check your DNS suffix search list and ensure you are querying the internal DNS servers provided by the VPN.
Does Ivanti Pulse Secure work on Windows 11 without issues?
Yes, Ivanti Pulse Secure is fully compatible with Windows 11. However, you must ensure you are using the latest version of the client supported by your organization. Older versions may have compatibility issues with newer Windows kernel updates or security features like Core Isolation.
What should I do if my internal printer is not visible?
Printers are often on a different subnet than standard workstations. Contact your IT department to confirm if the printer's subnet is included in your VPN routing rules. If it is not, they must add it to your allowed routes. You cannot fix this by changing local Windows settings alone.
How do I reset my Ivanti connection if it is stuck?
Open the Ivanti Pulse Secure tray icon, select "Disconnect," wait ten seconds, and then select "Connect." If this fails, restart the "Ivanti Pulse Secure" service in Windows Services (services.msc). A full reboot of your computer is the most reliable way to clear stuck network states.