The global pandemic has redefined the way people interact and work. The workplace has shifted from office cubicles to home desks, which requires applications that enable seamless collaboration among the workforce. For home-based workers, access to business services must be reliable, consistent, and secure. It should provide an experience that is similar to the office facility. Routing all of the traffic through the corporate network using traditional VPNs increases the traffic volume, slows down access to resources, and negatively impacts the remote user experience.

Cisco OEAP provides secure communications from a controller to an access point (AP) at a remote location, seamlessly extending the corporate WLAN over the internet to an employee's residence. Cisco OEAP provides segmentation of home and corporate traffic using the Split Tunnelling feature, which allows for home device connectivity without security risks to corporate policy.

Split tunnelling classifies the traffic sent by a client, based on packet content, using ACLs. Matching packets are switched locally from Cisco OEAP, and other packets are centrally switched over CAPWAP. Clients on a corporate SSID can talk to devices on a local network (printers, wireless devices on a personal SSID, and so on) directly without consuming WAN bandwidth, by sending packets over CAPWAP.

Traffic to Software as a Service (Saas) applications such as Cisco WebEx, Microsoft SharePoint, Microsoft Office365, Box, Dropbox, and so on that is required as part of the work routine, need not go through the corporate network, by using the Split Tunnelling feature.

The Cisco OEAP advertises two SSIDs, one corporate and one personal. Corporate SSID clients obtain their IP address from the central DHCP server in the corporate network. If split tunneling is enabled and a client wants to access a device in the home network, the AP performs NAT (PAT) translation between the wireless client corporate network subnet and the home network where the AP is located.

The personal SSID is configurable by a Cisco OEAP user. Clients will either get their IP address from the home router (when the AP personal SSID firewall is disabled) or from the internal AP DHCP server (when the AP personal SSID firewall is enabled). In the latter scenario, if the clients want to reach the home network devices, the AP perform sNAT (PAT) translation between the wireless client's internal network and the home network where the AP is located.

IPv6 Address Support

From Cisco IOS XE Cupertino 17.8.1, IPv6 addressing is supported. You can disable IPv6 addressing only by disabling the feature.

Note	The end-to-end network should support IPv6, that is, both the corporate network (controller, corporate gateway, and so on) and the home network (wireless clients, home router, and so on) should support IPv6.

• Cisco Wave 2 APs or Cisco Catalyst 9100AX Series Access Points

• URL filter list that matches the ACL name configured in split tunneling

• Cisco OEAPs are not supported when Cisco Embedded Wireless Controller on Catalyst Access Points (EWC) is used as a controller.

• Mesh topology is not supported.

• Clients connected on personal SSID or on home network (AP native VLAN) cannot discover devices on the corporate network.

• Split tunnelling is not supported in standalone mode.

• URL split tunnelling supports only up to 512 URLs.

• Action (deny or permit) can be specified only on the URL filter list, not for each individual entry.

• If URL-based ACL contains wild-card URLs, a maximum of 10 URLs are supported.

• The amount of snooped DNS IP addresses is limited as follows:

  • An AP can snoop 4095 IP addresses per DNS response, if IP addresses are less than 150,000.

  • An AP can snoop 10 IP addresses per DNS response, if IP addresses are between 150,000 and 200,000.

  • An AP can snoop five IP addresses per DNS response, if IP addresses are between 200,000 and 250,000.

  • An AP can snoop one IP address per DNS response, if IP addresses are greater than 250,000.

• A maximum of 128 IP address ACE (rules) can be used in the IP ACL for split tunnelling.

• URL-based split tunnelling only works with IPv4 addresses.

• The following restrictions are specific to IPv6 addressing

  • Multihoming (multiple router advertisement prefixes) is not supported (If a home network receives multiple prefixes, the one used by the AP that is connected to the controller is used.)

  • Roaming is not supported.

  • Filtering is not supported on the upstream traffic towards the wireless client.

  • Split tunneling is disabled for clients with duplicate IPv6 addresses. Traffic for these clients is forwarded centrally to the controller.

  • DHCPv6 prefix delegation is not supported for wireless clients.

  • If the corporate prefix length is smaller than the home prefix length, split tunneling for a particular client is disabled.

Before Release 17.7.1, split tunneling used IP ACLs. This meant that cloud services such as Cisco Webex were accessed directly without going through the corporate network. The network administrator maintained the list of IP addresses that Cisco Webex used, which was a daunting task. From Release 17.7.1, using the Cisco OEAP Split Tunneling feature, the network administrator needs to provide only the DNS names that Cisco Webex uses. The AP ensures that traffic from these DNS names is routed directly to the internet without using the corporate network.

1. Create an IP address ACL or URL ACL

2. Add ACL to FlexConnect Profile

3. Enable Split Tunnelling on Policy Profile

4. Verify the Configuration