The Vendor VPN That Bypasses the Proxy
A company requires all employee web traffic to traverse a forward proxy for logging and DLP. A new engineering team installs a third-party VPN client on laptops to reach a cloud build service. The VPN is split-tunnel: only the build service's IP range goes through the tunnel, and all other traffic uses the local route. The proxy is configured via a PAC file. Engineers report the build service works, but the security team notices those laptops' web traffic no longer appears in proxy logs during VPN sessions, and some build artifacts are being pulled from a public CDN that is not in the tunnel range. There is no endpoint firewall policy blocking split-tunnel VPNs, and the proxy is enforced only by PAC configuration.
1. Why does split-tunnel VPN cause the proxy logs to go dark, and what control gap does this reveal?
Read the worked answer
With split tunneling, only the build-service range is routed through the tunnel; everything else follows the local default route. The PAC file is delivered by the corporate network/DNS and is only honored while the machine is on the corporate path. Once the VPN client takes over routing, the PAC may be bypassed or the proxy unreachable, so traffic goes direct. The gap is that proxy enforcement is advisory (PAC-based), not mandatory: there is no network-level enforcement (e.g., egress firewall requiring proxy, or transparent proxy) and no endpoint policy preventing split-tunnel VPNs. The build artifacts pulled from a public CDN that is outside the tunnel range confirm traffic is leaving unproxied.
2. The business needs the build service. Propose a design that keeps the service working while restoring visibility, and name the trade-offs.
Read the worked answer
Options: (1) Full-tunnel VPN with split-exclude for the CDN only, so all other traffic is proxied - restores logging but increases VPN load and latency; (2) Route the build service and CDN through the corporate egress/transparent proxy so artifacts are inspected - preserves split-tunnel but requires the proxy to be in-path and may break TLS-pinned CDN downloads; (3) Allowlist the build service and CDN at the egress firewall and log at the firewall - restores visibility without full tunnel, but firewall logs are coarser than proxy/DLP logs. Trade-offs: full tunnel costs bandwidth/latency; in-path proxy may break pinned TLS; firewall allowlisting weakens DLP depth. The durable fix is to make proxy enforcement mandatory (egress firewall + endpoint policy) so a split-tunnel client cannot silently bypass it.