The VPN gateway server must enforce a no split-tunneling policy to all remote clients.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-30951	NET-VPN-220	SV-40993r1_rule	ECSC-1	Medium

Description
A VPN hardware or software client with split tunneling enabled provides an unsecured backdoor to the enclave from the Internet. With split tunneling enabled, a remote client has access to the Internet while at the same time has established a secured path to the enclave via an IPSec tunnel. A remote client connected to the Internet that has been compromised by an attacker in the Internet, provides an attack base to the enclave’s private network via the IPSec tunnel. Hence, it is imperative that the VPN gateway enforces a no split-tunneling policy to all remote clients.

Description

A VPN hardware or software client with split tunneling enabled provides an unsecured backdoor to the enclave from the Internet. With split tunneling enabled, a remote client has access to the Internet while at the same time has established a secured path to the enclave via an IPSec tunnel. A remote client connected to the Internet that has been compromised by an attacker in the Internet, provides an attack base to the enclave’s private network via the IPSec tunnel. Hence, it is imperative that the VPN gateway enforces a no split-tunneling policy to all remote clients.

STIG	Date
IPSec VPN Gateway Security Technical Implementation Guide	2018-03-08

Details

Check Text ( C-39609r1_chk )
Review the ISAKMP client configuration groups used to push policy to remote clients and determine if split tunneling is allowed. Split tunneling is commonly enabled by specifying an access control list within the client’s group policy. The access control list specifies what traffic flows are protected; hence, any traffic to destinations not declared in the access control list is forwarded outside of the IPSec tunnel by the remote client. If there is no access control list specified within a client configuration group, then packets for all destinations are transported within the IPSec tunnel.

Check Text ( C-39609r1_chk )

Review the ISAKMP client configuration groups used to push policy to remote clients and determine if split tunneling is allowed. Split tunneling is commonly enabled by specifying an access control list within the client’s group policy. The access control list specifies what traffic flows are protected; hence, any traffic to destinations not declared in the access control list is forwarded outside of the IPSec tunnel by the remote client. If there is no access control list specified within a client configuration group, then packets for all destinations are transported within the IPSec tunnel.

Fix Text (F-34759r1_fix)
Disable split tunneling on all ISAKMP client configuration groups.