The F5 BIG-IP appliance providing remote access intermediary services must disable split-tunneling for remote clients' VPNs.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
medium	V-266172	SRG-NET-000512-ALG-000062	F5BI-AP-300161	SV-266172r1024404_rule	2024-09-20	1

Description
Split tunneling would in effect allow unauthorized external connections, making the system more vulnerable to attack and to exfiltration of organizational information. A VPN hardware or software client with split tunneling enabled provides an unsecured backdoor to the enclave from the internet. With split tunneling enabled, a remote client has access to the internet while at the same time has established a secured path to the enclave via an IPsec tunnel. A remote client connected to the internet that has been compromised by an attacker on the internet, provides an attack base to the enclave’s private network via the IPsec tunnel. Hence, it is imperative that the VPN gateway enforces a no split-tunneling policy to all remote clients.

Description

Split tunneling would in effect allow unauthorized external connections, making the system more vulnerable to attack and to exfiltration of organizational information. A VPN hardware or software client with split tunneling enabled provides an unsecured backdoor to the enclave from the internet. With split tunneling enabled, a remote client has access to the internet while at the same time has established a secured path to the enclave via an IPsec tunnel. A remote client connected to the internet that has been compromised by an attacker on the internet, provides an attack base to the enclave’s private network via the IPsec tunnel. Hence, it is imperative that the VPN gateway enforces a no split-tunneling policy to all remote clients.

ℹ️ Check
If the BIG-IP appliance does not provide remote access intermediary services, this is not applicable. Access Profile: From the BIG-IP GUI: 1. Access. 2. Profiles/Policies. 3. Access Profiles. 4. Click the name of the Access Profile. 5. Click the Access Policy tab and note the name(s) of the Network Access listed. Network Access List: From the BIG-IP GUI: 1. Access. 2. Connectivity/VPN. 3. Network Access (VPN). 4. Network Access Lists. 5. Click on the Name of the Network Access List. 6. Network Settings tab. 7. Verify "Force all traffic through tunnel" is selected under Client Settings >> Traffic Options. If the BIG-IP appliance is not configured to disable split-tunneling for remote client VPNs, this is a finding.

ℹ️ Check

If the BIG-IP appliance does not provide remote access intermediary services, this is not applicable. Access Profile: From the BIG-IP GUI: 1. Access. 2. Profiles/Policies. 3. Access Profiles. 4. Click the name of the Access Profile. 5. Click the Access Policy tab and note the name(s) of the Network Access listed. Network Access List: From the BIG-IP GUI: 1. Access. 2. Connectivity/VPN. 3. Network Access (VPN). 4. Network Access Lists. 5. Click on the Name of the Network Access List. 6. Network Settings tab. 7. Verify "Force all traffic through tunnel" is selected under Client Settings >> Traffic Options. If the BIG-IP appliance is not configured to disable split-tunneling for remote client VPNs, this is a finding.

✔️ Fix
Obtain the Network Access name in the Access Profile: From the BIG-IP GUI: 1. Access. 2. Profiles/Policies. 3. Access Profiles. 4. Click the name of the Access Profile. 5. Click the Access Policy tab and note the name(s) of the Network Access listed. Configure the Network Access List: From the BIG-IP GUI: 1. Access. 2. Connectivity/VPN. 3. Network Access (VPN). 4. Network Access Lists. 5. Click on the Name of the Network Access List. 6. Network Settings tab. 7. Select "Force all traffic through tunnel" under Client Settings >> Traffic Options. 8. Click "Update".

✔️ Fix

Obtain the Network Access name in the Access Profile: From the BIG-IP GUI: 1. Access. 2. Profiles/Policies. 3. Access Profiles. 4. Click the name of the Access Profile. 5. Click the Access Policy tab and note the name(s) of the Network Access listed. Configure the Network Access List: From the BIG-IP GUI: 1. Access. 2. Connectivity/VPN. 3. Network Access (VPN). 4. Network Access Lists. 5. Click on the Name of the Network Access List. 6. Network Settings tab. 7. Select "Force all traffic through tunnel" under Client Settings >> Traffic Options. 8. Click "Update".