Verify dynamic split tunneling configuration

Verify dynamic split tunneling configuration in a Firewall Threat Defense device

From the Firewall Threat Defense device CLI, run these commands to verify the dynamic split tunneling configuration:

• show running-config webvpn : View details of the remote access VPN policy.

  ftd# show run webvpn
  webvpn
  enable outside
  anyconnect-custom-attr dynamic-split-exclude-domains
  anyconnect-custom-attr dynamic-split-include-domains
  http-headers
  hsts-server
  enable
  max-age 31536000
  include-sub-domains
  no preload
  hsts-client
  enable
  content-security-policy
  anyconnect image disk0:/csm/anyconnect-win-4.1005111-webdeploy-k9.pkg regex "Windows"
  anyconnect profiles xmltest disk0:/csm/xmltest.xml
  anyconnect enable
  tunnel-group-list enable
  cache
  disable
  certificate-group-map cert_map_test 10 cert_auth
  error-recovery disable
  

• show running-config group-policy <group-policy-name>: View details of the group policy of the remote access VPN policy.

  ftd# show run group-policy Secure_Client_Local_Auth
  group-policy Secure_Client_Local_Auth attributes
  vpn-idle-timeout 30
  vpn-simultaneous-logins 3
  vpn-session-timeout none
  vpn-filter none
  vpn-tunnel-protocol ssl-client
  split-tunnel-policy tunnelspecified
  ipv6-split-tunnel-policy-tunnelall
  split-tunnel-network-list value AC_networks
  Default-domain none
  split-dns none
  address-pools value AC_pool
  anyconnect-custom dynamic-split-exclude-domains value cisco.com
  anyconnect-custom dynamic-split-include-domains none
  

Verify dynamic split tunneling configuration on Secure Client

Click the Statistics () icon and choose VPN > Statistics. You can confirm the domains under the Dynamic Split Exclusion or Inclusion category.