Routing with the Cato Client (Split Tunnel Policy)

The Split Tunnel policy gives you granular control over how the Cato Client routes remote user traffic. By default, the Client routes traffic through the tunnel to the Cato Cloud to benefit from full security inspection and enforcement, and path optimization over the Cato backbone. However, there may be situations that require adaptive routing, for example, for optimizing the performance of real-time media services or when running alongside third-party vendors.

Use the Split Tunnel Policy to define how the Client routes traffic: to bypass the tunnel and route directly to the Internet destination or inside the tunnel for inspection.

When users are behind a Cato site, traffic routing depends on whether the Client is in Office Mode: 

• In Office Mode, the user is treated as behind the site, and traffic is routed according to the Network Rule policy

• When the Client is not in Office Mode, the user is treated as a remote user, and the Split Tunnel policy controls how the Client routes the traffic

Split Tunnel Rule Settings

Rules are matched based on multiple criteria, including user identity, geolocation, operating system, and Source Network. You can define either inclusive or exception-based rules. For example:

The Routing Configuration supports:

This level of control allows you to optimize security coverage while minimizing latency and preserving direct access to trusted resources.

The Split Tunnel Policy is an ordered rule base that sequentially checks if a rule is met. When a user meets a rule, the traffic routing settings based on that rule are applied. If no rule is met, traffic is routed through the Cato Cloud, and LAN access is allowed.

The Split Tunnel policy is only applied when the users are connecting via the Client. However, in office mode, the Client detects the Cato site, and the site configuration determines which traffic is steered to the Cato Cloud.

To include IP ranges that are exceptions to the Split Tunnel settings, add the IP ranges to a Global IP Range entity.

For more information, see Including and Excluding Traffic for the Split Tunnel Policy.

Note: When Windows SMB Multichannel is enabled on a device, SMB traffic may bypass the Split Tunnel policy and use the Cato tunnel, even when the SMB destination is excluded by the policy.

The Microsoft Defender 'Isolate' feature requires you to send traffic directly to the Windows Defender Cloud IP addresses. By default, the Cato Client sends traffic through the Cato network adapter. However, Microsoft Defender expects the traffic to originate from the Microsoft Defender Adapter, causing a communication failure between Microsoft Defender and Windows Defender Cloud.

To configure Microsoft Defender to work with the Cato Client, define a rule in the Split Tunnel policy to send traffic to the Microsoft Defender addresses.

You can let users configure Split Tunnel settings in the Client. Users can upload files with the IP ranges that are included or excluded from the tunnel.

Note: This option is not recommended for production environments and should only be used in exceptional cases where centralized policy control is not required.