VPN Split Tunneling: The Benefits and Risks

[@Jotin8664]

This was short and straight to the point! Loved it

[@larrshinshin7606]

I love learning networking concepts from Charles Manson! Keep 'em coming!

[@TeflonGeneral]

😂😂

[@1.9.9.1]

He looks like a staring contest world champion lmao great video brotha, helps understand the process for sure. 👍

[@devcentral]

Thanks! And, appreciate the comment.

[@crescentaerialimaging]

I'm impressed with the backwards writing! lol.

[@HagenvonEitzen]

I would have created a mirrored label for my shirt, written normally, and mirrored the video :)

[@Za-xh9tj]

@@HagenvonEitzen i saw this then i realized, ah nvm. but then i look at his shirt, the devcentral is not mirrored. so he is actually writing in reversed lol

[@sagehudson2408]

i guess im randomly asking but does someone know a trick to log back into an Instagram account? I was dumb lost my account password. I appreciate any assistance you can give me

[@jaxsonharrison9461]

@Sage Hudson instablaster ;)

[@pnp109]

Love it Peter ! Very clear and helpful ! Thank you :)

[@devcentral]

Thanks! Glad you enjoyed and we appreciate the comment!

[@sust77]

While he was teaching, it felt I already knew him and then I realized he looks like Simon from GOT TALENT, and he has got some talent definitely . Thanks for the Lecture

[@Littleanimalsarecute]

New subscriber 🐿🐿🐿 The squirrels loved the reminder to sign our work. Sometimes they sign my chair 😁. One of their funnier pranks as they wait for me to come back outside and see if I sit in the chair before I notice. Anyway, great video. 👍

[@devcentral]

Glad you lied it and we appreciate the comment!!

[@sbmasonator]

Super helpful, pal.

[@psilvas]

thanks much! Appreciate the comment! ps

[@francessmith2265]

Thanks Pete

[@devcentral]

Appreciate the comment!! thanks! (this is Peter answering!) 🙂

[@monnombre6547]

awesome explanation!!!

[@crazebane4394]

Thanks needed this

[@intel_da_developer4791]

Great video

[@devcentral]

Appreciate the comments!

[@intel_da_developer4791]

Learning to be a hacker now

[@princecyril4233]

Thanks 🙏🙏

[@thomasdotmp3]

couldn't watch because the squeaking marker was breaking me

[@snasheet]

Split Tunnel is generally against the best practices as internet bound traffic is not get inspected by the firewalls however having split tunnel enabled allow users to forward latency sensitive traffic directly to internet (not via VPN tunnel), Most companies enabled split tunnel for voice and video traffic as VPN encryption/decryption adds overhead which affect the performance sensitive applications.

[@JasonRahm]

Salman Nash many companies take that security posture for sure, but policies differ on requirements. Also for situations like we are in now where capacity planning didn’t foresee 100x increases in resources, splitting off nonessential traffic while the entire workforce is at home eases the burden on infrastructure allowing mission critical traffic to pass.

[@alastavi9630]

@@JasonRahm I think so O365 reduce the max users on F5 APM, enable the split tunneling to O365 in direct. Web trafic through cloud proxy or other solution and the corp trafic in the tunnel. O365 without split tunneling on APM is divise by 2 the max CCU value.

[@beefyjoe2084]

anyone else thought the white dot was a dead pixel on their monitor for a second

[@tld8102]

how do you write inverted and left hand

[@devcentral]

this is how we do the Lightboard Lessons: kzbin.info/www/bejne/i2iokH9qrKiDisU

[@indieshack4476]

Very helpful summary if split tunnelling (and how do you write backwards so well!)

[@psilvas]

Hey thanks! Appreciate the note. You can see how we do this with this tweet: twitter.com/psilvas/status/1113495222502088704?lang=en Or, watch this video Jason and John did showing how: kzbin.info/www/bejne/i2iokH9qrKiDisU

[@montchofrejus]

Is he really writing backwards. That’s genius

[@devcentral]

Thanks for the comment! This is how we do these: kzbin.info/www/bejne/i2iokH9qrKiDisU

[@unknownuser-sr2zh]

ooh!! i forgot to sign my work... LOL

[@LoneWoIfPack19]

I'm a moron. I still don't know what apps I should or shouldn't be using with a VPN

[@JasonRahm]

not at all! You are not alone, and this is a driving force for the edge technology discussion. Does it make sense to centralize control for everything, carrying all the traffic back to corporate to process before sending outbound? Or does it make sense to push some of that decision making out to the client-edge so security and performance can be managed closer to the source?

[@The3lloba]

Does anyone know how an RDP connection to a host that’s on VPN with split-tunneling disabled can be done?

[@hillfordh816]

I think many companies were forced to move to split tunneling whether they wanted to or not to alleviate the bottlenecks in their offices. For the internet bound now traffic maybe a solution like open dns or cisco umbrella could add a layer or visibility?

[@sdotagain312]

Is bridging the users home network and the corporate network a risk with split tunnel?

[@devcentral]

Hi SB~ Could be *if* bridging mode is enabled. In order to route a private Internet connection into a VPN, the user's client has to have the bridging mode activated & typically this is not a default setting. Also an administrator can use a group policy to deactivate the bridging feature and prevent the user from activating it. If the concern is potentially infecting a corporate network with malware through a private connection that could happen. However, almost every company uses antivirus software to eliminate malware before it enters the company’s systems. Infected USB drives on a local machines is probably more of a risk than internet traffic overall. So, the risk of infection through split tunneling is highly unlikely.

[@NathanAnsari]

Would split tunneling be able to solve an issue for example such as being disconnect with the exchange server in outlook when VPN is actualy instead of having to keep starting Outlook first and then connect to the VPN when it comes down to O365? Does anybody know by any chance?

[@devcentral]

Depending on your infrastructure, if O365 is your Outlook feeder, then you might not need a VPN connection at all. You could Federate the credentials through a VPN controller but not necessarily need a tunnel. Some do split-tunnel with O365 (MS Recommended) so that only traffic for the corp network goes over the tunnel while O365 goes to the appropriate cloud. You could also create application specific tunnels for things like Outlook, so that all email goes thru the tunnel and any other traffic (public, that is) would go out through your ISP.

[@yotty97]

but how do app-based split tunnel work? like in the PIA and expressvpn apps- there u can choose specific apps to over the vpn or not

[@devcentral]

In this instance, we have AppTunnels. This is where only a particular application, like Outlook or a CRM or RDP, etc, will get a specific encrypted tunnel only for that traffic/application. It can be configured to launch when the user clicks their app. Everything else goes thru the regular internet connection like normal. Hope that helps?

[@yotty97]

@@devcentral but how does it work? does it require a WFP callout driver? how to setup specific routing rules unique for an app?

[@devcentral]

Sorry, I should have also included these. Manual Chapter APM: Configuring App Tunnel Access - techdocs.f5.com/en-us/bigip-15-1-0/big-ip-access-policy-manager-application-access/configuring-app-tunnel-access.html and Manual Chapter TMOS: Route Domains - techdocs.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/tmos-routing-administration-13-0-0/8.html

[@yotty97]

@@devcentral thx

[@ayleafs]

why is there reverb on the audio lmao

[@charliebrown7328]

Is the opposite of split-tunneling full way tunneling?

[@devcentral]

No split tunnel means everything, including Netflix, etc traffic, goes through the encrypted tunnel.

[@bertvandegrift7200]

@@devcentral That's wrong. Split Tunnel means that corporate data goes through the tunnel, Netflix and other public traffic goes straight to the public internet.

[@psilvas]

@@bertvandegrift7200 we should have replied with, 'Not using split-tunnel' rather than No split tunnel since it could be taken as No, split-tunnel... :-)

[@molinadennis]

The way like you make this presentation is very insecure.

[@TV-ob1if]

huh