see this http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080702999.shtml

i suggest you use the ASDM to modify your vpn group for split-tunneling.

Please rate is this helps.

Hi, we don't want to split the traffic all traffic needs to internet the ASA as we monitor the URL's.

whiteford ,

with the Split tunneling you can use ACL to control access to your corporate network across the tunnel by restricting what servers users can access based on TCP/UDP port for example. All other traffic such as instant messaging or casual browsing is sent out to the Internet via the local LAN of the VPN Client.

But what if I need the Internet traffic to be filtered by our Websense URL server which is at the HQ where the ASA is? It would mean their internet traffic is not monitored.

i am trying to understand your requirements. Not sure how the websense work but when the ASA send internet requests to the websense software, are you filtering based on user account in Active directory or IP address?

The Internet needs to come in on the same route as the rest of the traffic as the URL's are monitored by our internal websense url filtering server, we need to make sure this traffic is monitored. The only way I can see this working is if I leave that http/https rule to "any" then it all works, but means they can access internal sites they don't need to.

Hi Whiteford,

When you enable split tunneling,any vpn user if he wants to access Internet it will go via like the rest of other traffic.So as in your case the rest of traffic goes via the url filtering server then access the internet.So same like this the will happen when a VPN user access the Internet

Rate it this helps!!

Regards,

Archana.

whiteford

On your ASA, configure what to filter via the following commands:

*note* in this sample, all urls from any host and to any host will be filtered.

filter url http 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 allow

Any http traffic through the ASA from any devices on the inside inclduing vpn users will be send to your websense server for filtering

Do I still need to split the tunnel, if so how?

Sorry for my slow understanding, I just assumed that splitting the tunnel meant the remote sites internet didn't even come over the VPN to the ASA and out again.

Thanks

see this http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080702999.shtml

like i said use the ASDM to make the change

on the split-tunnel config, both internal and unencrypted internet traffic will pass through the ASA

Will this work for my Site-to-Site VPN too? I see the example only for Cisco VPN clients?

Many thanks

The split-tunnel applies only to remote vpn users.

for the site-site vpn are you saying you want to filter web traffic also?

It will be filtered eventually but at the moment the only way to open give them the Internet is if I create a rule on the outside to inside for the site-to-sites IP ranges on http/https, but this also mean full web access to internal servers.