Split Tunneling Not Working

[Joshua Smick]

I'm working on a home lab setup with my 5506-X, and I've been having an issue configuring split tunneling.  Every change I seem to make either gives me internet access, gives me access to the LAN, or takes away both.  The current configuration I have has taken away both, and I'm a bit stumped.  I've attached the configuration.  Any guidance would be greatly appreciated!  

[Philip D'Ath · Accepted solution]

Change:

split-tunnel-policy excludespecified

to:

split-tunnel-policy tunnelspecified

I note you are using 192.168.0.0/24.  Make sure you are not VPN'ing from a 192.168.0.0/24 address as well (or an subnet that is also the same as your subnet you are trying to access remotely) or it will not work.

On the whole, you should avoid using 192.168.0.0/24 and 10.0.0.0/24 in production networks because they are so frequently used in home networks.

I also note you have IKEv2 configured.  IKEv2 does not support split tunnelling.  SO make sure you are only using the AnyConnect client in SSL mode.

[Joshua Smick]

That did the trick.  I had to solve an issue with DNS traffic not making it across the tunnel after that, but it's fine now.  I've been meaning to change the IP address scheme, but then I would have to go in and change all the VLANs, IP addresses on the virtual machines, DNS names, etc.  

[Dinesh Moudgil]

Hi Joshua,

You might want to tweak split-dns parameter under group-policy.

split-dns

To enter a list of domains to be resolved through the split tunnel, use the split-dns command in group-policy configuration mode. To delete a list, use the no form of this command.

To delete all split tunneling domain lists, use the no split-dns command without arguments. This deletes all configured split tunneling domain lists, including a null list created by issuing the split-dns none command.

When there are no split tunneling domain lists, users inherit any that exist in the default group policy. To prevent users from inheriting such split tunneling domain lists, use the split-dns none command.

split-dns { value domain-name1 domain-name2 domain-nameN | none }

no split-dns [ domain-name domain-name2 domain-nameN ]

Ref:
http://www.cisco.com/c/en/us/td/docs/security/asa/asa-command-reference/S/cmdref3/s16.html#pgfId-1560462


Regards,
Dinesh Moudgil

P.S. Please rate helpful posts.