Guest traffic split tunnel in full tunnel deployment

[satyamothukuri]

Hello,

I would like to know if we can split tunnel only one  VLAN(Guest) if i am using all other vlan in full tunnel mode.

Currently all my uses traffic is full tunneled including guest. So is there any way we can only send guest traffic at the remote site itself instead of tunneling to DC. 

[ww]

If you dont select the vlan  to be part of vpn it wil  use the local internet.   (But  it  cant reach  the remote vpn subnets.)

[satyamothukuri]

what about default router for the guest network, will it be local ISP or will it have from DC?

4 VLAN's should have default router from Dc and 1 VLAN from local ISP, is this possible.

[ww]

Is you dont select the vlan to be in vpn, it will use the default  route to your  primary  local WAN 

[satyamothukuri]

will there be any issues in terms of security, if i dont have adv sec ? 

its guest traffic, but what to know will there be any sec issues.

[MerakiDave]

Hi @satyamothukuri if you are just sending guests out on a guest VLAN that is not part of the VPN, that's your call if you want to leverage the Advanced Security license to turn on IPS, AMP and content filtering for example. Generally speaking that's a common practice to leverage those features even for the guest VLAN. The split tunnel / full tunnel toggle is a hub by hub setting, not VLAN by VLAN. So as @ww mentioned just don't include the Guest VLAN in the VPN, and use full tunnel back to your hub. If you check the "default route" box for a given hub, that is then full tunnel, unchecked gives you split tunnel. It may be less of a technical question and more of a policy question specific to your organization to decide if you'll need to leverage the Adv Sec features for the Guest subnet.