The VPN client on the endpoint device will be configured to disable or disallow split tunneling.

Part of SRC-EPT-800 Split tunneling on the VPN

Associated with IA controls: ECSC-1

SV-6819r1_rule The VPN client on the endpoint device will be configured to disable or disallow split tunneling.

Vulnerability discussion

Split tunneling needs to be disabled so traffic is not visible to two networks at the same time. This means that printing for teleworkers will not be available. (Remote Only)

Check content

Execute the software’s dialer applet from the Programs menu. The selections may vary depending on the products used for the VPN client. Verify that split tunneling is disabled or that tunneling is enabled in the Properties dialog box. Upon the establishment of a VPN connection to a DOD network, no other connections of any kind will be established. Next, verify that the setting for “local LAN access” is not selected. For example, if home networks are used, no connection between the device and other home network devices will be established during a VPN session. If Split Tunneling is used for VPN communications or if local LAN access is permitted, even for printing purposes, this is a finding.

Fix text

Configure the VPN so that split tunneling is disabled.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.