Cisco 5505 - ASA Firewall Edition Bundle, Cli Configuration Manual

Page: 1689 / 2164

1-55
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring Connection Profiles, Group Policies, and Users
Group Policies
Set the rules for tunneling traffic by specifying the split-tunneling policy for IPv6 traffic:
hostname(config-group-policy)# ipv6-split-tunnel-policy { tunnelall | tunnelspecified |
excludespecified
}
hostname(config-group-policy)# no ipv6-split-tunnel-policy
The default is to tunnel all traffic . To set a split tunneling policy, enter the split-tunnel-policy command
in group-policy configuration mode. To remove the split-tunnel-policy attribute from the running
configuration, enter the no form of this command. This enables inheritance of a value for split tunneling
from another group policy.
The excludespecified keyword defines a list of networks to which traffic goes in the clear. This feature
is useful for remote users who want to access devices on their local network, such as printers, while they
are connected to the corporate network through a tunnel. This option applies only to the Cisco VPN
client.
The tunnelall keyword specifies that no traffic goes in the clear or to any other destination than the ASA.
This, in effect, disables split tunneling. Remote users reach Internet networks through the corporate
network and do not have access to local networks. This is the default option.
The tunnelspecified keyword tunnels all traffic from or to the specified networks. This option enables
split tunneling. It lets you create a network list of addresses to tunnel. Data to all other addresses travels
in the clear and is routed by the remote user’s Internet service provider.
Note
Split tunneling is primarily a traffic management feature, not a security feature. For optimum security,
we recommend that you do not enable split tunneling.
The following example shows how to set a split tunneling policy of tunneling only specified networks
for the group policy named FirstGroup:
hostname(config)# group-policy FirstGroup attributes
hostname(config-group-policy)# split-tunnel-policy tunnelspecified
hostname(config)# group-policy FirstGroup attributes
hostname(config-group-policy)# ipv6-split-tunnel-policy tunnelspecified
Specify a Network List for Split-Tunneling
Prerequisites
•
You have set an IPv4 or IPv6, or both an IPv4 and IPv6, split tunnel policy using Setting the
Split-Tunneling Policy .
•
You have created IPv4 or IPv6 Unified ACLs to specify as a network list to split-tunnel. If you have
set both a split tunnel policy for IPv4 networks and IPv6 networks, the network list (unified ACL)
you specify in the command will be used for both protocols. So, the network list should contain
access list entries (ACEs) for both IPv4 and IPv6 traffic. If you have not created these Unified ACLs,
see
Adding ACLs and ACEs, page 26-2 .
Procedure
Specify a network list (unified access list) for split tunneling using the split-tunnel-network-list
command in group-policy configuration mode.
hostname(config-group-policy)# split-tunnel-network-list { value access-list_name | none }
hostname(config-group-policy)# no split-tunnel-network-list value [ access-list_name ]
Split tunneling network lists distinguish networks that require traffic to travel across the tunnel from
those that do not require tunneling. The ASA makes split tunneling decisions on the basis of a network
list, which is an ACL that consists of a list of addresses on the private network.