In my last scenario all traffic was sent over the tunnel:
First I add a new access list:
asa1(config)# access-list SPLIT-TUN standard permit host 192.168.202.222
next, I need to change group policy settings:
group-policy VPN-GP attributes split-tunnel-policy excludespecified split-tunnel-network-list value SPLIT-TUN
I try now to establish the VPN connection.
On the ASA I see the access list associated with split tunneling and split tunneling policy:
Dec 10 07:27:56 [IKEv1 DEBUG]Group = VPN-ASA, Username = cisco, IP = 192.168.202.232, IKEGetUserAttributes: split tunneling list = SPLIT-TUN Dec 10 07:27:56 [IKEv1 DEBUG]Group = VPN-ASA, Username = cisco, IP = 192.168.202.232, IKEGetUserAttributes: Split Tunneling Policy = Local Lan
Now I should be able to send traffic to the host 192.168.202.222 but there is one problem:
When we look at the second tab you can notice that one (mandatory !!!) parameter is not enabled (Local LAN: disabled):
Let’s fix it:
and connect once again:
As you see now this one IP address is excluded from encryption domain. On the client side you can also find following logs:
Let’s send some traffic to check if it works as expected:
Now I test if I can ping hosts behind the ASA:
So, everything works fine.
I’d like to mention about one thing. Assume the host 18.104.22.168 is a www server in DMZ and you don’t need to protect the traffic between client and this server. You can add this IP to the access list (SPLIT-TUN) and the traffic will not be encrypted:
asa1(config)# access-list SPLIT-TUN standard permit host 22.214.171.124
now let’s send some traffic to the host 126.96.36.199:
As you see everything is working as expected. You can exclude the traffic from the VPN tunnel which is directed to host in different location but also to the LAN just behind the VPN server.