An organization configures a remote access VPN solution using the Cisco AnyConnect Secure Mobility Client for mobile employees. To conserve corporate headquarter bandwidth, the network administrator must enable a feature that encrypts and routes traffic destined for internal corporate subnets through the VPN tunnel, while permitting general internet traffic to access the internet directly via the remote user's local network connection. Which VPN feature should the administrator configure to satisfy this requirement?
- Split tunnelingAnswer
- BFull tunneling
- CGeneric Routing Encapsulation (GRE) tunneling
- DPort Address Translation (PAT)
Answer
The correct feature is split tunneling, which selectively routes corporate-bound traffic over the VPN tunnel while allowing local internet traffic to bypass the tunnel.
Split tunneling is explicitly designed for remote access VPN deployments to separate traffic destined for internal corporate networks from public internet traffic. By defining specific corporate destination subnets in the VPN gateway policy, the client software only sends traffic matching those destination networks into the IPsec/SSL VPN tunnel, allowing all other internet traffic to egress locally.
Step-by-Step Solution
Key Concept
Split Tunneling vs Full Tunneling in Remote Access VPNs