Examkin

Question

Difficulty: HardRemote Access and Site-to-Site VPN Concepts

An enterprise network administrator is configuring a remote access VPN client profile on a security appliance to support mobile remote workers. The administrator enables split-tunneling to optimize bandwidth usage on the corporate Internet connection. Which two statements accurately describe the operational characteristics of this split-tunneling configuration?

  1. Only traffic destined for explicitly defined corporate IP address ranges is encrypted and routed through the secure VPN tunnel.Answer
  2. B
    All IP traffic from the remote client, regardless of destination, is encapsulated and redirected through the corporate VPN gateway.
  3. Unencrypted public Internet traffic from the client host routes directly out of the local network interface to its local ISP.Answer
  4. D
    Enabling split-tunneling extends the internal Layer 2 broadcast domain across the WAN directly to the remote client's network adapter.
  5. E
    Split-tunneling requires TACACS+ authentication protocol extensions to encrypt local client destination IP routing tables.

Answer

The correct operational characteristics of split-tunneling are that only traffic destined for specified corporate subnets is encrypted and routed through the VPN tunnel, while general Internet-bound traffic from the remote client routes directly out of its local Internet connection.
Split-tunneling separates corporate-bound IP traffic from public Internet traffic on a remote client. When split-tunneling is enabled on the VPN gateway, an access control list specifies which enterprise subnets must be sent through the encrypted IPsec or SSL tunnel. Any client traffic not matching these enterprise subnets bypasses the tunnel and routes directly out of the client's local physical interface to the Internet, conserving corporate WAN bandwidth.

Step-by-Step Solution

1
Analyze the core distinction between full-tunneling and split-tunneling in remote access VPN deployments.
Full-tunneling forces 100% of client traffic through the headend appliance, whereas split-tunneling segregates client traffic based on destination IP address.
Understanding traffic path selection is essential for evaluating bandwidth consumption and network security policies.
2
Evaluate corporate subnet routing behavior under split-tunneling.
Traffic directed toward internal enterprise networks matches the VPN split-tunnel access list and gets encapsulated into the encrypted IPsec or SSL tunnel.
This maintains secure access to internal private resources.
3
Evaluate Internet traffic behavior under split-tunneling.
Traffic addressed to public Internet destinations bypasses the VPN interface and is routed out the remote endpoint's local network interface directly to the local ISP.
This prevents unnecessary WAN bandwidth consumption and overhead at the corporate edge security gateway.

Key Concept

Split-Tunneling in Remote Access VPNs
Rate this question

Topics

Remote Access and Site-to-Site VPN Concepts

More questions from this topic