Free DISA STIG and SRG Library | Vaulted


The VPN gateway server must enforce a no split-tunneling policy to all remote clients.

Finding ID
Rule ID
Cat II
Group Title
The VPN gateway server allows split-tunneling.
Target Key

A VPN hardware or software client with split tunneling enabled provides an unsecured backdoor to the enclave from the Internet. With split tunneling enabled, a remote client has access to the Internet while at the same time has established a secured path to the enclave via an IPSec tunnel. A remote client connected to the Internet that has been compromised by an attacker in the Internet, provides an attack base to the enclave’s private network via the IPSec tunnel. Hence, it is imperative that the VPN gateway enforces a no split-tunneling policy to all remote clients.

Fix Text

Disable split tunneling on all ISAKMP client configuration groups.

Check Content

Review the ISAKMP client configuration groups used to push policy to remote clients and determine if split tunneling is allowed. Split tunneling is commonly enabled by specifying an access control list within the client’s group policy. The access control list specifies what traffic flows are protected; hence, any traffic to destinations not declared in the access control list is forwarded outside of the IPSec tunnel by the remote client. If there is no access control list specified within a client configuration group, then packets for all destinations are transported within the IPSec tunnel.


Information Assurance Officer

IA Controls