SC.L2-3.13.7Split Tunneling
Prevent remote devices from simultaneously establishing non-remote connections with organizational systems and communicating via some other connection to resources in external networks (i.e., split tunneling).
[a]
remote devices are prevented from simultaneously establishing non-remote connections with the system and communicating via some other connection to resources in external networks (i.e., split tunneling).
Always-on full tunnel with local LAN access and NIC bridging disabled in client policy
Implementation
AO coverage. Addresses the single Split Tunneling objective for managed endpoints that can reach CUI.
Client posture. The VPN profile is deployed by MDM, set to always-on with user-logon connect, and users cannot disable or uninstall it. Split tunnel is off: the client installs a default route through the gateway, so there is no “corporate traffic here, internet traffic there” configuration to get wrong. Access to the local subnet is explicitly disabled, which is the setting most often left on by default and is the practical form split tunneling takes on a home network.
Simultaneous-connection prevention. Endpoint policy blocks network bridging and disables unused adapters, so a laptop cannot sit on the tunnel and a second physical or virtual NIC at the same time. Hypervisor bridged mode on developer machines is restricted to NAT so a guest VM cannot become an unmanaged second path. Personal hotspot tethering is allowed only as the transport underneath the tunnel, never alongside it.
Captive portals. The client permits a short, narrowly scoped pre-logon window so hotel and airport portals can be completed. That window is time-boxed, logged, and alerted on if a device sits in it beyond the limit — this is the one intentional exposure in the pattern, and it is treated as such rather than left undocumented.
Print and local device exception path. Because local LAN access is off, home printing is handled by a cloud print path rather than by re-enabling the setting. Requests to re-enable local LAN access are denied by standard, with the cloud print alternative documented in the help desk article.
Maintenance. Monthly report of devices whose tunnel uptime is anomalously low. Quarterly test on a rebuilt laptop: confirm the default route goes to the gateway, confirm the local subnet is unreachable, and confirm bridging is blocked. Re-validate after each client version upgrade, since upgrades occasionally reset defaults.
Accepted gap. Two field tablets used at customer sites cannot run the VPN client. They reach a single allow-listed application through a remote browser isolation session with no local download, hold no CUI at rest, and their exception is renewed annually.
What the evidence looks like
- GlobalProtect client configuration export showing no split tunnel and local LAN access disabled
- MDM profile assignment proving the VPN profile is enforced and non-removable
- Endpoint policy blocking network bridging / restricting hypervisor networking
- Quarterly rebuilt-laptop test notes (default route, local subnet unreachable)
- Captive-portal dwell alert sample and the field tablet exception record
Environment
Tools
Was this example useful?
Quick reaction — no account needed. For reasoning that moves the community meter, cast a full verdict below.
Discussion(0)
No discussion on this example yet
Verdicts capture a conclusion. Use a thread when the interesting part is the argument.
Sign in to start a thread.