Cisco ASA Series Cli Configuration Manual page 1690

Group Policies
If you use extended ACLs, the source network determines the split-tunneling network. The destination
network is ignored. In addition, because any is not an actual IP address or network address, do not use
the term for the source in the ACL.
The value access-list name parameter identifies an access list that enumerates the networks to tunnel or
not tunnel. The access list can be a unified ACL with ACEs that specify both IPv4 and IPv6 addresses.
The none keyword indicates that there is no network list for split tunneling; the ASA tunnels all traffic.
Specifying the none keyword sets a split tunneling network list with a null value, thereby disallowing
split tunneling. It also prevents inheriting a default split tunneling network list from a default or specified
group policy.
To delete a network list, enter the no form of this command. To delete all split tunneling network lists,
enter the no split-tunnel-network-list command without arguments. This command deletes all
configured network lists, including a null list if you created one by entering the none keyword.
When there are no split tunneling network lists, users inherit any network lists that exist in the default
or specified group policy. To prevent users from inheriting such network lists, enter the
split-tunnel-network-list none command.
The following example shows how to set a network list called FirstList for the group policy named
FirstGroup:
hostname(config)# show runn group-policy FirstGroup attributes
hostname(config-group-policy)# split-tunnel-network-list value FirstList
Run the show runn group-policy attributes command to verify your configuration. This example
shows that the administrator has set both an IPv4 and IPv6 network policy and used the network list
(unified ACL), FirstList for both policies.
hostname(config-group-policy)# show runn group-policy FirstGroup attributes
group-policy FirstGroup attributes
split-tunnel-policy tunnelspecified
ipv6-split-tunnel-policy tunnelspecified
split-tunnel-network-list value FirstList
Configuring Domain Attributes for Tunneling
You can specify a default domain name for tunneled packets or a list of domains to be resolved through
the split tunnel. This section describes how to set these domains and includes the following topics:
Defining a Default Domain Name for Tunneled Packets
The ASA passes the default domain name to the IPsec client to append to DNS queries that omit the
domain field. When there are no default domain names, users inherit the default domain name in the
default group policy. To specify the default domain name for users of the group policy, enter the
default-domain command in group-policy configuration mode. To delete a domain name, enter the no
form of this command.
hostname(config-group-policy)# default-domain {value domain-name | none}
hostname(config-group-policy)# no default-domain [domain-name]
The value domain-name parameter identifies the default domain name for the group. To specify that
there is no default domain name, enter the none keyword. This command sets a default domain name
with a null value, which disallows a default domain name and prevents inheriting a default domain name
from a default or specified group policy.
Cisco ASA Series CLI Configuration Guide
1-56
Chapter 1 Configuring Connection Profiles, Group Policies, and Users