Juniper NETWORK AND SECURITY MANAGER, Manual

Page: 177 / 340

Defining Network Connect Split Tunneling Policies (NSM Procedure)
Network Connect (NC) split tunneling policies specify one or more network IP
address/netmask combinations for which the device handles traffic passed between
the remote client and the corporate intranet. You can also specify traffic that should not
pass through the NC tunnel.
When split-tunneling is used, NC modifies routes on clients so that traffic meant for the
corporate intranet networks to NC and all other traffic goes through the local physical
adapter. The IVE tries to resolve all DNS requests through the physical adapter first and
then routes those that fail to the NC adapter.
For example,
• If split tunneling is disabled and the exclude route contains 10.204.50.0/24, then all
traffic except 10.204.50.0 networks will go through NC.
•
If split tunneling is enabled and the included route contains 10.204.64.0/18 and the
exclude traffic contains 10.204.68.0/24, networks from 10.204.64.0/18 to
10.204.127.0/18 will pass through the NC tunnel. The 10.204.68.0/24 network will not
pass through the NC tunnel.
•
If split tunneling is enabled and the include route contains 10.204.64.0/24 (subnet of
the excluded route), and the exclude route contains 10.204.64.0/18 (super set of the
included route), then the included network’s traffic will still be routed through the NC
tunnel.
To write an NC split-tunneling networks resource policy:
1.
In the navigation tree, select Device Manager > Devices . Click the Device Tree tab,
and then double-click the Secure Access device for which you want to write an NC
split-tunneling networks resource policy.
2.
Click the Configuration tab. Select Users > Resource Policies > Network Connect >
Split-tunneling Networks .
3.
Click New Profile , and then enter the name and the description for the policy.
4.
Add or modify more settings as specified in Table 39 on page 159.
5.
Click one:
•
OK —Saves the changes.
•
Cancel —Cancels the modifications.
Table 39: Configuring Network Connect Split Tunneling Policy Details
Your Action Options
Enter the new resource name for the split tunnel resource policy. Resources
159 Copyright © 2010, Juniper Networks, Inc.
Chapter 10: Configuring Secure Access Resource Policies