A field-service technician connects to the utility's network from a truck using remote-access VPN to reach a work-order dispatch application, while all other internet traffic from the laptop should continue to go out the technician's own mobile hotspot instead of through the utility's network. Which VPN concept controls this behavior?
Select an answer to reveal the explanation.
Short Explanation
Split tunneling is like giving the technician's laptop two roads out: one narrow, protected road that only goes to the utility's dispatch system, and the regular open road for everything else, like general web browsing. Without it, every byte of traffic — dispatch app or not — would be forced through the tunnel.
Full Explanation
Split tunneling is the remote-access VPN feature that routes only traffic destined for defined internal subnets or the corporate network through the encrypted tunnel, while all other traffic — general internet browsing, streaming, or anything not matching the tunnel's routes — continues to use the client's local internet connection directly. This is exactly the behavior described: the technician's dispatch-application traffic goes through the tunnel to the utility's network, while unrelated internet traffic exits via the mobile hotspot. Dead peer detection is a keepalive mechanism that determines whether the tunnel peer is still reachable and triggers renegotiation or teardown if it isn't; it has no role in deciding which traffic is routed where. The claim that phase 2 selectors don't apply to remote-access sessions is incorrect — remote-access IPsec and SSL VPN both still rely on selectors or routes to define what is 'inside' the tunnel, which is the same underlying mechanism split tunneling depends on. Source NAT on a tunnel interface is unrelated to the routing decision being described; NAT would change how addresses appear to the destination, not which traffic enters the tunnel in the first place, and forcing all traffic through NAT would actually be closer to full-tunnel behavior, the opposite of what's being asked. An administrator can confirm split tunneling is active by reviewing the routes pushed to the client, or in FortiOS, the split-include or split-exclude configuration under the relevant VPN portal or IPsec phase 2 settings.