Split tunnel question

[Jay Cambell]

How do I set up split tunnel so that the user is pulling internet local and not from the anyconnect client? 

[Philip D'Ath]

I am going to assume you are using an ASA.

First create an access list stating what resources are internal.

access-list vpn-access standard permit 192.168.0.0 255.255.0.0 

And then add it to your VPN policy.

group-policy xxx attributes
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value vpn-access

[Jay Cambell]

Ok. If I need the user to access specific devices on the network I would create the below.

Group-policy xxx attributes

vpn-filter value blockaccess

access-list blockaccess permit x.x.x.x x.x.x.x

access-list blockaccess deny ip any any

I have a question if you dont know the local ip address on the specified network for split tunnel how do you configure it?

[Philip D'Ath]

Yes, that concept will work.  And yes - you need to know the IP address of anything you want to allow or block.  It is not possible to configure something you do not know.