When on VPN, the Internet does not get filtered.

[haggittmark@tm-america.com]

When we are in the office, bad sites get blocked by the webfilter in the ASA firewall.  At home on VPN, the websites do not get blocked and our external IP does not show correctly.  It's as if the Internet is coming through the ISP and not the VPN tunnel.  How do I change this?  
At one time someone put a split-tunnel in the firewall to permit Internet traffic on VPN, but maybe they did not do it correctly.

[balaji.bandi]

if the VPN configured split-tunnel all the traffic apart from the internal network all go directly using DSL ISP

if want to all the traffic pass via your corporate network - then you need to contact the administrator to make it work.

[haggittmark@tm-america.com]

I am the administrator and don't know what to do.  That's why I was replacing servers and editing the ASA.

[Richard Burts]

I am a bit puzzled by this statement "At one time someone put a split-tunnel in the firewall to permit Internet traffic on VPN, but maybe they did not do it correctly." The typical implementation of split tunnel for Remote Access VPN is to have corporate traffic use the VPN and to have Internet traffic use the remote ISP connection and not the VPN. We do not know how your VPN was set up and what kind of split tunnel (if any) is configured. Perhaps you could post a sanitized copy of your ASA configuration and we might be able to give better advice.

[haggittmark@tm-america.com]

What if we want Internet traffic to be filtered (people not doing bad things on their work laptop) while users are at home on VPN through their ISP?  what can be done about that?  Is it standard prctice to use a split-tunnel?

[Richard Burts]

There are always the possibility of local conditions that are exceptions to the norm, but in general there are 2 approaches to Remote Access VPN:

- tunnel everything. In this approach the ISP connection is used to establish the VPN connection and then all traffic from the laptop is sent through the VPN to corporate, and all Internet traffic is subject to corporate security policies and filtering (nothing is sent from the laptop to the ISP to get to the Internet). This approach does increase the amount of traffic that the corporate firewall must process, and does increase the bandwidth requirement for the corporate Internet connection. But this approach is the most secure and organizations who adopt this approach realize that this increase in resource requirements is just part of the cost of doing business securely.

- split tunnel. In this approach corporate traffic is sent through the VPN to corporate while all other traffic is sent directly to the remote ISP. This approach reduces the demand on corporate Internet resources, but does not protect what the user is doing on the Internet.

If you (and your organization) are concerned about protecting users who are on their laptop at home, it is a pretty clear choice that you should remove any split tunneling that is configured on your firewall and make sure that your Remote Access VPN uses the tunnel everything approach.

[haggittmark@tm-america.com]

if I remove the split-tunnel how do ensure all traffic is routed trough VPN?

[Richard Burts]

If split tunnel is removed then when the vpn is active there is not way out except the vpn. If you want to be sure about that then probably the best thing would be to do a traceroute to some destination on the Internet. The traceroute should show traffic going to the vpn head end and then being routed to Internet from there.

[haggittmark@tm-america.com]

To turn off split-tunnel do I simply choose "Tunnel all Networks" as shown in the picture?

[Richard Burts]

Yes I believe that this would do it. 

[haggittmark@tm-america.com]

What does the "inherit" check box mean?  do I need to check that,  does that Mean it will tunnel what ever is in the regular ACL list?

[Richard Burts]

The inherit check box means that it would inherit this policy from a higher level policy. I believe that there are several places where you can make selection between split tunnel policy and tunnel all policy. You would need to make sure that none of those places selected the split tunnel option.