nerdexam
Cisco

300-730 · Question #209

A network administrator is implementing WebVPN on Cisco ASA and wants to apply a split-tunnel policy with this command: ASA(config-group-policy)# split-tunnel-network-list value SPLIT_TUNNEL The SSL…

The correct answer is A. access-list SPLIT_TUNNEL standard permit 10.10.1.0 255.255.255.0. Split-tunnel policies on Cisco ASA reference a standard ACL whose name must exactly match the value specified in the split-tunnel-network-list command, and the ACL permits the networks that must be routed through the tunnel.

Remote Access VPN

Question

A network administrator is implementing WebVPN on Cisco ASA and wants to apply a split-tunnel policy with this command: ASA(config-group-policy)# split-tunnel-network-list value SPLIT_TUNNEL The SSL VPN client must traffic to 10.10.1.0/24 network must go through the tunnel. Which configuration completes this policy?

Options

  • Aaccess-list SPLIT_TUNNEL standard permit 10.10.1.0 255.255.255.0
  • Baccess-list SPLIT_TUNNEL standard deny 10.10.1.0 255.255.255.0
  • Caccess-list split-tunnel-network-list extended permit 10.10.1.0 255.255.255.0
  • Daccess-list SPLIT_TAUNNEL extended permit 10.10.1.0 255.255.255.0

How the community answered

(43 responses)
  • A
    81% (35)
  • B
    2% (1)
  • C
    5% (2)
  • D
    12% (5)

Why each option

Split-tunnel policies on Cisco ASA reference a standard ACL whose name must exactly match the value specified in the split-tunnel-network-list command, and the ACL permits the networks that must be routed through the tunnel.

Aaccess-list SPLIT_TUNNEL standard permit 10.10.1.0 255.255.255.0Correct

Cisco ASA split-tunnel network lists require a standard access list - not an extended one - that permits the networks to be tunneled. The ACL name SPLIT_TUNNEL matches the value specified in the split-tunnel-network-list command exactly, and the permit keyword correctly designates 10.10.1.0/24 as traffic that must traverse the VPN tunnel.

Baccess-list SPLIT_TUNNEL standard deny 10.10.1.0 255.255.255.0

Using deny excludes the network from the split-tunnel list, meaning traffic to 10.10.1.0/24 would bypass the tunnel rather than be routed through it.

Caccess-list split-tunnel-network-list extended permit 10.10.1.0 255.255.255.0

The ACL name 'split-tunnel-network-list' does not match the required name 'SPLIT_TUNNEL', and extended ACLs are not the correct type for split-tunnel network lists on Cisco ASA.

Daccess-list SPLIT_TAUNNEL extended permit 10.10.1.0 255.255.255.0

The ACL name 'SPLIT_TAUNNEL' is misspelled and will not match the 'SPLIT_TUNNEL' value referenced in the group policy command, so the split-tunnel policy will never be applied.

Concept tested: ASA split-tunnel standard ACL configuration for SSL VPN

Source: https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/70847-asa-vpn-splitdns.html

Topics

#WebVPN#split tunneling#access-list#group policy

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 300-730 Practice