I have set up the ASA as VPN Server (SSL). Everything works great. I can reach every office network and also the Internet.

Now I noticed that on our old network, the configuration was different. When we connected over the old VPN (IPsec), and we browsed the Internet, we didn't use the tunnel to our router. We used the Internet of our Client.

In other words, we didn't appear with the outside IP address from the office router to the Internet, we appeared with our own IP address (from my home).

I googled, but I don't find the correct configuration tutorial. Maybe I'm looking wrong. What I need is Split tunneling.

  • As far as I know, Cisco VPNs do not allow split tunneling, and even actively remove that from your PC configuration if you add a route to do that on your PC. This is a security feature.
    – Ron Maupin
    Commented Jul 8, 2016 at 8:41
  • Really? That's sad, because we don't have a big bandwidth in our office and so every download goes through my VPN instead of my highspeed DLS at home ... but this would explain why I don't find a Guide for doing this. Commented Jul 8, 2016 at 8:45
  • 1
    It prevents you from setting up a backdoor to/from the office network and the public Internet, which which makes the office network vulnerable. If the network administrator sets up policies for controlled Internet access, split tunneling can be used to bypass the security and policies set up by the network administrator.
    – Ron Maupin
    Commented Jul 8, 2016 at 8:49

1 Answer 1


You can define an ACL and apply the ACL under the group policy using the split tunnel value command. You can then apply the group policy to the tunnel group.

It's explained in the documentation here:


Below will tunnel traffic only for the network.

access-list Split standard permit

group-policy ANYCONNECT-POLICY attributes
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value Split

tunnel-group ANYCONNECT general-attributes
 default-group-policy ANYCONNECT-POLICY

If you open your anyconnect client when connected and click the cog (advanced properties) and click on the route details tab you will see as a secured route and as an unsecured route.

  • Thanks! Found this article before. Works like a charm :-) Commented Jul 15, 2016 at 11:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.