Skip to content
ControlVerdict
Sign in
SC.L2-3.13.7CMMC Level 2Level 2

Split Tunneling

Submit your own example

Practice statement

Prevent remote devices from simultaneously establishing non-remote connections with organizational systems and communicating via some other connection to resources in external networks (i.e., split tunneling).

Quoted verbatim from NIST SP 800-171 Rev. 2 §3.13.7.Source

The source document’s non-normative “Discussion” section is not reproduced here. ControlVerdict quotes normative text verbatim or omits it — it never paraphrases a standard. Follow the source link above for the full context.

Assessment Objectives(1)

An assessor determines each objective separately. “Mostly implemented” is not a result — every objective below has to stand on its own.

  1. [a]

    remote devices are prevented from simultaneously establishing non-remote connections with the system and communicating via some other connection to resources in external networks (i.e., split tunneling).

    1 example covers this

Objective text quoted verbatim from NIST SP 800-171A via the CMMC Level 2 assessment guide.

Implementation examples(1)

Submit your own example
  • addresses
    SC.L2-3.13.7Split Tunneling
    Prevent remote devices from simultaneously establishing non-remote connections with organizational systems and communicating via some other connection to resources in external networks (i.e., split tunneling).

    • [a]

      remote devices are prevented from simultaneously establishing non-remote connections with the system and communicating via some other connection to resources in external networks (i.e., split tunneling).

    Always-on full tunnel with local LAN access and NIC bridging disabled in client policy

    ControlVerdict Corpus@cv-corpusOSCJul 31, 2026
    Community is just starting — add yours. No verdicts yet.

    Implementation

    AO coverage. Addresses the single Split Tunneling objective for managed endpoints that can reach CUI.

    Client posture. The VPN profile is deployed by MDM, set to always-on with user-logon connect, and users cannot disable or uninstall it. Split tunnel is off: the client installs a default route through the gateway, so there is no “corporate traffic here, internet traffic there” configuration to get wrong. Access to the local subnet is explicitly disabled, which is the setting most often left on by default and is the practical form split tunneling takes on a home network.

    Simultaneous-connection prevention. Endpoint policy blocks network bridging and disables unused adapters, so a laptop cannot sit on the tunnel and a second physical or virtual NIC at the same time. Hypervisor bridged mode on developer machines is restricted to NAT so a guest VM cannot become an unmanaged second path. Personal hotspot tethering is allowed only as the transport underneath the tunnel, never alongside it.

    Captive portals. The client permits a short, narrowly scoped pre-logon window so hotel and airport portals can be completed. That window is time-boxed, logged, and alerted on if a device sits in it beyond the limit — this is the one intentional exposure in the pattern, and it is treated as such rather than left undocumented.

    Print and local device exception path. Because local LAN access is off, home printing is handled by a cloud print path rather than by re-enabling the setting. Requests to re-enable local LAN access are denied by standard, with the cloud print alternative documented in the help desk article.

    Maintenance. Monthly report of devices whose tunnel uptime is anomalously low. Quarterly test on a rebuilt laptop: confirm the default route goes to the gateway, confirm the local subnet is unreachable, and confirm bridging is blocked. Re-validate after each client version upgrade, since upgrades occasionally reset defaults.

    Accepted gap. Two field tablets used at customer sites cannot run the VPN client. They reach a single allow-listed application through a remote browser isolation session with no local download, hold no CUI at rest, and their exception is renewed annually.

    What the evidence looks like

    • GlobalProtect client configuration export showing no split tunnel and local LAN access disabled
    • MDM profile assignment proving the VPN profile is enforced and non-removable
    • Endpoint policy blocking network bridging / restricting hypervisor networking
    • Quarterly rebuilt-laptop test notes (default route, local subnet unreachable)
    • Captive-portal dwell alert sample and the field tablet exception record

    Environment

    Remote-heavy engineering team on Windows and macOS laptops; Palo Alto GlobalProtect always-on for every managed endpoint.

    Tools

Discussion(0)

No discussion on this control yet

Edge cases, scoping questions, and “would this pass?” scenarios belong here.

Sign in to start a thread.