Skip to main content
vinch100
New Member
August 19, 2019
Solved

SSLVPN - Negated Split Tunneling

  • August 19, 2019
  • 1 reply
  • 4937 views

Hello,

 

we want to achieve a special case where our external users would use the VPN for all traffic EXCEPT some well known VoIP Gateway that we want them to access through their local breakout, IPSec VPN has the command ipv4-split-exclude but I cannot find the same feature on SSL-VPN... any idea ?

 

Best regards

 

Vincent

    Best answer by Kenundrum

    This is by no means an elegant solution... but theoretically would work.

    You can turn on split tunneling and then make the routed addresses be all the address space except the VOIP gateway. You'll probably have to create an address with all IPs before the address, and another with all the IPs after it and put both in the tunnel portal config. I've had to do something similar with packet captures in the past and it did work.

    1 reply

    Kenundrum
    KenundrumAnswer
    New Member
    August 19, 2019

    This is by no means an elegant solution... but theoretically would work.

    You can turn on split tunneling and then make the routed addresses be all the address space except the VOIP gateway. You'll probably have to create an address with all IPs before the address, and another with all the IPs after it and put both in the tunnel portal config. I've had to do something similar with packet captures in the past and it did work.

    vinch100
    vinch100Author
    New Member
    August 19, 2019

    Thank you Kenundrum, that sound like a good workaround !

    neonbit
    New Member
    August 20, 2019

    6.2 introduced a negate feature for firewall addresses (in address groups). They work well with policies, but have never tested for SSLVPN tunnel mode. Worth giving it a try as it's alot easier to configure.