CESA can then see which of all that traffic–down to user/device/application/software-process/domain/port/source/destination level–is going over the VPN tunnel. This flow data provides detailed insight to applications generating/receiving traffic on the endpoint, as well as who the user is, domains they are communicating with (whether the user knows it or not) and all source/destinations. This is where CESA comes in.ĬESA collects highly detailed traffic telemetry from An圜onnect VPN clients. But deciding what is “safe” to move to a split-tunnel is a challenge without detailed visibility into what types of traffic the VPN endpoints are generating. Furthermore, networks may need to offload more traffic than the obvious SaaS services to maintain acceptable end-user performance. But with split tunneling comes a lack of visibility into traffic traversing it, since that traffic is no longer coming back to the security stack at the “headquarters”.

As such, offloading specific types of traffic like Office365, WebEx and other SaaS applications to a VPN “split tunnel” that directs traffic directly to its destination (instead of bringing it through the VPN concentrator) makes a lot of sense. VPN throughput, and the network performance it enables for users, is at a premium. Many networks would benefit from offloading as much remote worker traffic off their VPN infrastructure as possible. Scenario 1: Want to deploy split tunneling, but lack detailed traffic visibility to implement it Contact your Cisco account team or channel partner for details. Need increased remote work & VPN monitoring? Use CESA Splunk free for 90 days for licenses initiated before July 1. Let’s take a closer look at each of these scenarios. With many IT orgs resistant to deploying any new infrastructure, CESA allows IT to use what they already have deployed to gain the VPN, zero-trust and remote work endpoint visibility they seek. This is particularly useful for remote work endpoints that were rapidly deployed with less stringent that normal security compliance testing.Īn圜onnect and Splunk are the infrastructure for Cisco Endpoint Security Analytics (CESA), which provides the monitoring and security analytics to address the scenarios above.

Analyze security behavior of remote endpoints, users and VPN “top talkers”.

Monitor and further optimize traffic you put over your existing split tunnel deployment.Implement VPN split tunneling to alleviate VPN capacity constraints without sacrificing security.Using An圜onnect for VPN? Got Splunk? If so, you have what you need to secure, monitor and gain detailed endpoint visibility to:

Split tunneling cisco anyconnect