Core issue
Split tunneling for WebVPN users is not supported on the Cisco ASA or VPN Concentrator.
Split tunneling 'enforcement' is only available when using the SSL VPN Client or Cisco VPN Clients.
Resolution
For clientless sessions, the VPN Concentrator or ASA pushes the split tunneling policy because you cannot stop a user from opening a new browser window and going somewhere else.
Refer to Split Tunneling for VPN Clients on ASA Configuration Example for more information.
