Split Tunneling Security

Recall from Chapter 4, "Cisco VPN 3000 Remote Access Preshared Key Configuration," that an administrator can enable connecting clients to perform split tunneling. This ability allows the client to send encrypted traffic destined for the remote end of the tunnel. In addition, data destined for the outside world or the local LAN can bypass the encrypted tunnel and be sent as clear text out to the LAN or the Internet. If the client were somehow to be compromised by an attacker while the tunnel was still connected, an attacker could possibly use the client as a transport to attack the central location. A likely deterrent for this type of situation would be to install a software firewall client on the client's workstation. With the firewall in place, you add another layer of defense that attackers would need to break through to achieve their goals.