3 ms·
Split tunneling is only simple if you can control the IPs everything is hosted at. If your SaaS uses generic EC2/Azure IPs, do you want to split tunnel ALL traf
by xxpor 6y ago
Split tunneling is only simple if you can control the IPs everything is hosted at. If your SaaS uses generic EC2/Azure IPs, do you want to split tunnel ALL traffic to those providers? Probably not.
- abfan1127 6y agoI thought that all access to EC2/Azure IPs is over HTTPS or SSH so you don't need to tunnel to it. We use split tunnel for my work, all of my work's IPs go through the tunnel. Everything else is the individual HTTPS or SSH connection. If you were within your corporate wall, you'd still need HTTPS to get to Azure from inside, right?
- droopyEyelids 6y agoAside from accessing intranet resources: Is the corporate VPN for encrypting Internet traffic, or is it for proxying and monitoring employee traffic? Without answering that question, you can't discuss what makes sense.
- abfan1127 6y agoour corp VPN is for accessing internal sensitive documents. I'm sure there is some level of monitoring, but it isn't the first priority. I work for a large US Corp so we have lots of design, specs, reviews and other paperwork to access.
- gruez 6y agobut all the VPNed resources would be under private IPs anyways? In that case you only need your VPN to route traffic to your company's subnet.
- xxpor 6y agoMost companies want all general internet traffic to go through the VPN so they can filter/record/do whatever to it. The sites that are split tunneled are usually trusted internal (in that they're owned by the company, or used for a known service like email) or known high bw but safe (like youtube)
- c0nsumer 6y agoNot always, thankfully... Newer versions of Cisco AnyConnect (for example) can do name-based split tunnel. The client resolves the address then dynamically adds a route for the split tunnel as it's needed. It works excellently for cloud-hosted stuff.
- xxpor 6y agoAh that's quite interesting. There how do they work around the client controlling the DNS server? I suppose part of the session setup could be sending anyconnect a known trusted DNS server address.
- c0nsumer 6y agoI believe the DNS gets assigned to the client during the VPN session setup. And this is watched, and if something tries to change it, it shuts down the tunnel.