cancel
Showing results for 
Search instead for 
Did you mean: 

Split tunneling question

Highlighted
Contributor

Split tunneling question

We have several offsite users that VPN in using pulse. Is it possible to use split-tunneling(currently disabled) to allow them access to a single ip address at their remote location so they can print? (not an entire subnet) Thanks
20 REPLIES 20
Highlighted
Not applicable

Re: Split tunneling question

Hi SK, I believe it is possible. If you set a local route to your /32, either persistent on the remote machine by whatever method, or via a session script when NC/Pulse authenticates and set the "route override" option to "no" under the role options then that should do what you need. You need to make sure that other routes don't exist on the remote side that may undesirably trump Pulse routes you'd expect to go over the tunnel, that's why a script may be best. Have you tested anything yet, if so what and how did it work/not work? Cheers, James
Highlighted
Super Contributor

Re: Split tunneling question

Hi,

 

This is an interesting requirement.

 

when you enable split tunnleing, users have access to their own local network and that traffic is outside the runnel

 

They can either be given access  through terminal services bookmark on SA to a server and allowed to map ther local printers

 

Or on their network, they can configure a rule on the firewall that states any packet coming from source IP as pulse adapter IP be allowed to access only the printer IP

 

Regards,

Jay

Highlighted
Contributor

Re: Split tunneling question

Not sure what you mean by: They can either be given access through terminal services bookmark on SA to a server and allowed to map ther local printers Thanks for you help! sk
Highlighted
Super Contributor

Re: Split tunneling question

Hi,

 

I meant when you log into the admin UI, you can go to resource profiles-->select terminal services and then create RDP access to one of your internal servers

 

so once the terminal service bookmark is created, when you click on the bookmark, we can enable the option Connect local printers

 

The user experience will be users logs in SSL VPN, NC launches and they land on the homepage, they can click on the rdp bookmark and they will log into the terminal server and see their local printers mapped

 

Thanks,

Jay

Highlighted
Contributor

Re: Split tunneling question

Not sure if I understand your solution. We don't have a terminal server that user log in to. They just use pulse with split tunneling disabled (which blocks them from accessing their local(networked) printer). I could enable split tunneling for their entire subnet and allow them to use their local network printer, but I was looking for a way to limit them to accessing a single (printer) IP address on their local network. Thanks, sk
Highlighted
Super Contributor

Re: Split tunneling question

Hi Sk,

 

I do not think we can do that as their local traffic is not sent through the tunnel.They will have to configure a rule on their local firewall to limit access only to their local network printer if the source IP is the Pulse IP Pool range.

 

Regards,

Jai

Highlighted
Super Contributor

Re: Split tunneling question

Is the printer always on the same address?  Let's say that the local subnet is 192.168.1.0/24 and the printer is always on 192.168.1.100.  I believe you could define an inverse split-tunneling policy to say that everything except 192.168.1.100 is on the other side of the tunnel.  This would - I believe - accomplish your goal by creating a 192.168.1.100/32 route pointing to the physical interface instead of the VPN virtual interface.

 

I have not implemented inverse split tunneling, so I can't confirm that this would work.

 

If the printer resides on different addresses at different sites, I don't know of any way to achieve the functionality you wish.

 

Ken

Highlighted
Contributor

Re: Split tunneling question

address scheme of the offsite users is 10.175.0.* printer there would be like 10.175.0.100 when they VPN using pulse they are given a 192.168.1.* address for the vpn connection. I want all traffic to go thru the 192.168.1.* pulse interface except any traffic going to 10.175.0.100(printer) Thanks for response Ken
Highlighted
Frequent Contributor

Re: Split tunneling question


Hi Sk,

       You can use exclude option, In SA admin UI

1. User > Resource policies > VPN tunneling > Split tunneling networks

2. Create a New policy

3. In the Resources tab, enter the print ip address    10.175.0.100/255.255.255.255

4. Choose the roles accordingly

5. In Action tab select "Exclude access"

6. save the rule

7. Go to Role > VPN tunneling option > Enabled "Split tunnel"

Now, the traffic towards the printer ip should be going directly (out of tunnel), rest all the traffic should come via tunnel; I hope this is what you're looking for...! test this config..!

Thanks...