split-tunnel but include some public URLs.

Question

How can I configure a split-tunnel on APM for all the private IPs but also include some FQDNs that resolve to public IPs to go through the tunnel?&nbsp;

alexbct · Answer

Hi Shashe,&nbsp;
You should be able to achieve this with Address spaces (Access&nbsp;&nbsp;››&nbsp;&nbsp;Connectivity / VPN&nbsp;:&nbsp;Network Access (VPN)&nbsp;:&nbsp;Address Spaces)&nbsp;
Fill in the publicIP's of the application, together with their FQDN's, and then attach it to the tunnel, under the Split Tunneling section. More details:&nbsp;https://techdocs.f5.com/en-us/bigip-16-1-0/big-ip-access-policy-manager-network-access/configuring-address-spaces/what-is-address-space.html&nbsp;
Please note though that this address space only exists since version 16.1. If you are running on earlier versions, you should be able to achieve the same result with with the IP address space and DNS address space directly under the Split Tunneling configuration.&nbsp;
Hope this helps.&nbsp;

shashe · Answer

AlexBCT&nbsp;I see IP and DNS space in my settings. Can I just put the RFC 1918 space in the IP space tab and add public app's fqdn with wildcard for e.g. *.example.com in DNS space? Will this ensure all the private IPs along with any traffic to that public fqdn passes through the VPN tunnel? I'm little confused with the description has provided for these tabs.&nbsp;&nbsp;Thank you so much for your response.&nbsp;

shashe · Answer

Should I list the IPs of the public apps in the IP space? there are far too many for me to get a list. I thought a wildcard as mentioned above in the DNS space would solve my issue here. AM I wrong with that?

alexbct · Answer

Hi Shashe,&nbsp;
Yes, filling in the Public IP's as well as the FQDN's is what's needed - this will ensure the correct routes get injected when the tunnel gets created and the traffic traverses the tunnel. Yes, you can also use wildcards, as well as subnet definitions. If you have a whole bunch of separate IP's though, that will be quite a bit of work indeed.&nbsp;
If possible, you may then want to have a look at using the dynamic Address Space feature, which relies on an endpoint (Discovery URL) somewhere that contains (and maintains) a list of IP's that are relevant for that application. There are two predefined examples for Zoom and Office365 that you can use as examples.&nbsp;
For the rest I'd recommend just giving a test, and see where the traffic gets routed through.&nbsp;
Hope this helps.&nbsp;

shashe · Answer

AlexBCT&nbsp;Thanks for your response. I tried placing the wildcards(for e.g. *.example.com) in the DNS address space under Network settings in Connectivity/VPN tab. DNS requests are traversing the tunnel but http traffic to site.example.com is not traversing the tunnel. I donot want to add the IPs of all the sites/apps as they are too many and dynamic. Can you please help configure this?Thanks.

Forum Discussion

split-tunnel but include some public URLs.

Recent Discussions

Installing a PKCS 12 File onto an F5 Device

Irule to allow specific IPs

Uploading SKCS 12 File to F5 Device

F5 not Identifying Parameter in Text/Plain Upload

Migration from physical Hardware to R series

Related Content

SSL VPN Split Tunneling and Office 365

VPN Split Tunneling: The Benefits and Risks

Enriching AFM with public domain Threat Intelligence

SSLO in public cloud: Azure inbound L3 use case

Public Cloud Simplified with F5 NGINXaaS for Azure