Free DISA STIG and SRG Library | Vaulted

V-30951

The VPN gateway server must enforce a no split-tunneling policy to all remote clients.

Finding ID
NET-VPN-220
Rule ID
SV-40993r1_rule
Severity
Cat II
CCE
(None)
Group Title
The VPN gateway server allows split-tunneling.
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

A VPN hardware or software client with split tunneling enabled provides an unsecured backdoor to the enclave from the Internet. With split tunneling enabled, a remote client has access to the Internet while at the same time has established a secured path to the enclave via an IPSec tunnel. A remote client connected to the Internet that has been compromised by an attacker in the Internet, provides an attack base to the enclave’s private network via the IPSec tunnel. Hence, it is imperative that the VPN gateway enforces a no split-tunneling policy to all remote clients.

Fix Text

Disable split tunneling on all ISAKMP client configuration groups.

Check Content

Review the ISAKMP client configuration groups used to push policy to remote clients and determine if split tunneling is allowed. Split tunneling is commonly enabled by specifying an access control list within the client’s group policy. The access control list specifies what traffic flows are protected; hence, any traffic to destinations not declared in the access control list is forwarded outside of the IPSec tunnel by the remote client. If there is no access control list specified within a client configuration group, then packets for all destinations are transported within the IPSec tunnel.

Responsibility

Information Assurance Officer

IA Controls

ECSC-1