Security

Got a Q about VIA and split tunneling.

 

As i can read of the white paper on VIA, is that when you enable split tunneling the you have to say what network you want tunneled to you controllere not the other way, so if i want all Microsoft traffic to go out local and all other traffic tunneled to the controllere i need to whitelist all other traffic than microsoft? anyone have a solution for that? cause as i can see you can only whiteliste 32 ip adresse/subnets.

Hi,

 

Can you see if this is helpful:

 

https://www.arubanetworks.com/techdocs/VIA/3x/content/via%20config/configuring_via_settings.htm?Highlight=VIA%20tunneled%20networks#

---

@morjo wrote:

Got a Q about VIA and split tunneling.

 

As i can read of the white paper on VIA, is that when you enable split tunneling the you have to say what network you want tunneled to you controllere not the other way, so if i want all Microsoft traffic to go out local and all other traffic tunneled to the controllere i need to whitelist all other traffic than microsoft? anyone have a solution for that? cause as i can see you can only whiteliste 32 ip adresse/subnets.

---

Correct.  You have to choose what subnets you want tunneled.  You can summarize subnets to avoid listing 32 subnets.  For example, if you want your VPN user to send everything on the 10.0.0.0/8 subnet back to your datacenter, you can put that on a single line:

If you have any more questions, the VIA VPN Solution guide is here:  https://support.hpe.com/hpesc/public/docDisplay?docId=a00098430en_us

 

Thats what i feared. Microsoft have a huge list of ip adresses they use and it Changes all the time so i need to make summery adresses of what is not on the Microsoft list so dont Think its gonna work.

Hoping the via client gets app awereness in the future 

What traffic do you want to go back to your data center?  All traffic except for Microsoft?

Yes that was the idea.

VIA allows you to only "split" traffic based on subnet, but Aruba Remote APs allows you to define what should be split vs. tunneled with ACLs, instead.  That might meet your requirement:  https://support.hpe.com/hpesc/public/docDisplay?docId=a00097853en_us

 

I want to check from user app, what are subnets tunneled to controller,

where i can find this information in the via-app ?

On a Windows device you can execute "route print".  You cannot do it within a mobile app.

Make sense, thank you very much !!