Where is split tunneling defined for IKEv2 remote access clients on a Cisco router?

The IKEv2 authorization policy on a Cisco IOS router is the construct that specifies client-pushed attributes including route sets, which directly control split tunneling behavior by telling the client which prefixes to send through the tunnel versus the local internet. These attributes are delivered to the remote access client during IKEv2 negotiation via the Config payload. This is the IOS router equivalent of the ASA group policy split-tunneling configuration.

Group Policy is a configuration object used on Cisco ASA and FTD platforms, not on IOS router IKEv2 remote access deployments.

Virtual templates define logical interface properties and cloning behavior for tunnel interfaces but do not carry client-pushed attributes such as split tunneling route lists.

The webvpn context is specific to SSL VPN and WebVPN configuration on Cisco devices and has no role in IKEv2 remote access client attribute delivery.