A utility uses full-tunnel remote-access VPN so that all traffic from a technician's laptop, including general web browsing, is inspected by the NOC's FortiGate before reaching the internet. What operational cost does this design accept compared to split tunneling?

Full-tunnel remote-access VPN routes all client traffic, including unrelated general internet browsing, through the VPN link and the NOC FortiGate, which gives the utility the ability to apply consistent security inspection to everything a remote laptop does, but at the direct cost of consuming more bandwidth on the VPN link and more processing capacity on the FortiGate, since traffic that has nothing to do with utility business now has to be carried and inspected anyway. This is the core trade-off against split tunneling, which reduces that load by only sending relevant traffic through the tunnel. Claiming there is no operational cost ignores this trade-off entirely and is factually wrong — the reason split tunneling exists as a design option is precisely because full tunneling has a real bandwidth and processing cost. The claim that full tunneling prevents content inspection is backwards: full tunneling is typically chosen specifically because it lets the FortiGate apply its full suite of security profiles (web filtering, antivirus, IPS) to all of a remote user's traffic, not less of it. Dead peer detection is an independent keepalive feature that operates regardless of whether the tunnel is full or split; there is no such mutual exclusivity between DPD and full-tunnel mode, so this option invents a dependency that does not exist. To evaluate whether full tunneling is worth the cost for a given deployment, monitor VPN link utilization and FortiGate CPU/session counts during peak field-technician connection windows and compare against the utility's available bandwidth and appliance sizing.