The F5 BIG-IP appliance providing remote access intermediary services must disable split-tunneling for remote clients' VPNs.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-266172 | F5BI-AP-300161 | SV-266172r1024404_rule | Medium |
| Description |
| Split tunneling would in effect allow unauthorized external connections, making the system more vulnerable to attack and to exfiltration of organizational information. A VPN hardware or software client with split tunneling enabled provides an unsecured backdoor to the enclave from the internet. With split tunneling enabled, a remote client has access to the internet while at the same time has established a secured path to the enclave via an IPsec tunnel. A remote client connected to the internet that has been compromised by an attacker on the internet, provides an attack base to the enclave’s private network via the IPsec tunnel. Hence, it is imperative that the VPN gateway enforces a no split-tunneling policy to all remote clients. |
| STIG | Date |
| F5 BIG-IP TMOS ALG Security Technical Implementation Guide | 2025-06-09 |
Details
| Check Text (C-70096r1023762_chk) |
| If the BIG-IP appliance does not provide remote access intermediary services, this is not applicable. Access Profile: From the BIG-IP GUI: 1. Access. 2. Profiles/Policies. 3. Access Profiles. 4. Click the name of the Access Profile. 5. Click the Access Policy tab and note the name(s) of the Network Access listed. Network Access List: From the BIG-IP GUI: 1. Access. 2. Connectivity/VPN. 3. Network Access (VPN). 4. Network Access Lists. 5. Click on the Name of the Network Access List. 6. Network Settings tab. 7. Verify "Force all traffic through tunnel" is selected under Client Settings >> Traffic Options. If the BIG-IP appliance is not configured to disable split-tunneling for remote client VPNs, this is a finding. |
| Fix Text (F-69999r1023763_fix) |
| Obtain the Network Access name in the Access Profile: From the BIG-IP GUI: 1. Access. 2. Profiles/Policies. 3. Access Profiles. 4. Click the name of the Access Profile. 5. Click the Access Policy tab and note the name(s) of the Network Access listed. Configure the Network Access List: From the BIG-IP GUI: 1. Access. 2. Connectivity/VPN. 3. Network Access (VPN). 4. Network Access Lists. 5. Click on the Name of the Network Access List. 6. Network Settings tab. 7. Select "Force all traffic through tunnel" under Client Settings >> Traffic Options. 8. Click "Update". |