Configure dynamic split tunneling

Dynamic split tunneling allows you to fine-tune split tunneling based on DNS domain names. You can include or exclude specific DNS domains from your VPN tunnel. Excluded domains are not blocked, traffic to those domains is kept outside the VPN tunnel. For example, you can send Cisco WebEx traffic over the public internet, freeing up VPN bandwidth for traffic destined to your protected network.

Procedure

Step 1

Choose Secure Connections > Remote Access VPN.

Step 2

Click the edit icon next to the remote access VPN policy.

Step 3

Click the edit icon next to the connection profile that you want to modify.

Step 4

Click + to add a group policy or click Edit Group Policy.

Step 5

In the Add Group Policy or Edit Group Policy dialog box, click the Secure Client tab.

Step 6

From the left pane, click Custom Attributes and click +.

Step 7

In the Add Custom Attribute dialog box, configure these parameters:

  1. From the Secure Client Attribute drop-down list, choose Dynamic Split Tunneling.

  2. Click + next to the Custom Attribute Object drop-down list to create an object.

  3. In the Add Secure Client Custom Attribute dialog box, configure these parameters:

    1. In the Name field, enter the name for the custom attribute object.

    2. In the Include domains field, enter the domain names to route through the VPN tunnel.

      You can include domains that would otherwise be excluded based on their IP addresses.

    3. In the Exclude domains field, enter the domain names to route outside the VPN tunnel.

      Excluded domains are not blocked, their traffic simply routes outside the VPN tunnel.

    4. Click Save.

  4. Click Add.

Step 8

Click Save.

What to do next

  1. Deploy the configuration on the Firewall Threat Defense device.

  2. Verify the configured dynamic split tunnel configuration on the Firewall Threat Defense device and the Secure Client. For more information, refer to Verify dynamic split tunneling configuration.