tunnelspecified Vs excludespecified

[sandeep_bhalodia]

What is the difference between "tunnelspecified" Vs "excludespecified" split-tunnel policy? I have read Cisco documentation but it is still not clear. Here is my interpretation from the documentation:

tunnelspecified: In this option traffic matching the ACL will be encrypted and rest of the traffic will be in clear text

excludespecified: In this option traffic matching the ACL will be sent as a clear text while rest of the traffic will be encrypted/tunneled

Question 1:Cisco suggest to use excludespecified option If I want to use my local subnet/printer while connected to VPN.

But In tunnelspecified option If my local subnet is not a part of an ACL then traffic to my local LAN will be in clear text and that means i should be able to use my local printer/local subnet?

Please help me understand this difference.

Thanks in advance!!

[Jennifer Halim]

Yes, you are absolutely spot on with the difference between tunnelspecified and excludespecified.

I would normally see how many ACL I need to configure and depending on which is the smallest number then i would choose either of the option.

In regards to your question, I would just use tunnelspecified, as only traffic destined to the ACL will be encrypted and sent across the tunnel, the rest will split and use the local connection.