> For the complete documentation index, see [llms.txt](https://docs.plenit.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.plenit.com/docs-en/productos/servers-1/how-to/ikev2-and-split-tunneling.md).
# New VPN Configuration Improvements: IKEV2 and Split Tunneling
These tunnel options give you more control over the connection: you choose the **IKE version** used in negotiation and, when you work with several remote networks, you decide whether you enable **Split Tunneling**.
Everything from the panel, on a tunnel you already have set up.
> #### ๐ What you get
>
> A tunnel tailored to your topology and the equipment at the other end: with the appropriate IKE version and, if you want, a separate SA for each remote network.
### Before you start
* Have access to the Plenit panel with permissions over the network subscription.
* Have a VPN tunnel already created and operational. If you don't have one yet, set it up first:[ How to create a site-to-site VPN tunnel.](/docs-en/productos/servers/how-to/how-to-create-a-site-to-site-vpn-tunnel.md)
* For Split Tunneling, have declared **at least two remote networks** in the tunnel.
### Step 1. Configure the IKE version
The platform lets you choose the IKE version used when negotiating the tunnel:
* **IKEv1**: use it only if the remote equipment does not support v2.
* **IKEv2**: the recommended option, for compatibility, security, and stability.
* **Automatic**: the platform decides based on who initiates the connection.
In automatic mode, if **Plenit initiates** the connection tries IKEv2 by default (and may not be established if the remote side only accepts v1); if **Plenit responds** in passive mode, it adapts to the version proposed by the source.
When to use each one: **IKEv2** if both ends support it; **IKEv1** only if the remote does not support v2; **Automatic** if you don't control who always initiates the connection. If problems appear in automatic mode, explicitly set v1 or v2.
> #### ๐ง Changing the version renegotiates the tunnel
>
> Changing the IKE version forces the connection to be renegotiated. Schedule the change during a window without critical traffic.
### Step 2. Enable Split Tunneling
When you declare several remote networks in the same tunnel, Split Tunneling causes the platform to create a **separate SA (Security Association) for each network**, instead of grouping them into one. That gives you flexibility to adapt the connection to your network design and the behavior of the remote equipment.
In some environments a **single SA** (unified mode) works better; in others, separating the networks (Split Tunneling). The decision depends on your topology and the recommendations of the vendor at the other end.
{/\* ๐ธ CAPTURE 2 ยท Split Tunneling control enabled (visible with two or more remote networks) \*/}
| Mode | What it does | When it fits |
| --------------- | ----------------------------------- | ---------------------------------------------------- |
| Unified | A single SA for all remote networks | The remote equipment groups the networks into one SA |
| Split Tunneling | One SA for each remote network | You want to manage each network separately |
#### Conditions
* The Split Tunneling control **only appears with two or more remote networks** configured.
* **Requires IKEv2**: when enabled, the platform adjusts the tunnel version automatically.
* If the remote side works with a single SA, the tunnel remains active and functional in **unified mode**.
#### Compatibility between vendors
Each vendor groups or separates networks differently. This is not a compatibility issue: Plenit lets you choose the mode (unified or Split Tunneling) to adapt to your equipment. For reference:
### Check the configuration
After changing the IKE version or enabling Split Tunneling, confirm that the tunnel is still up and that each remote network is routing. From a server on your local network, run `ping` to an IP in **each** declared remote subnet:
```bash
ping
ping
```
And verify that there is a route to each remote subnet. On Linux:
```bash
ip route
```
In Windows, from PowerShell:
```powershell
route print
```
With Split Tunneling active, each remote network is validated separately: if one responds and another does not, the problem is in that specific network, not in the whole tunnel.
### If something does not fit
| Symptom | Likely cause | What to do |
| -------------------------------------------------- | ------------------------------------------------------ | ---------------------------------------------------------------------- |
| The tunnel does not come up in Automatic mode | The remote side only accepts IKEv1 and Plenit tried v2 | Explicitly set IKEv1 |
| The Split Tunneling control does not appear | There are fewer than two remote networks | Declare at least two remote networks in the tunnel |
| The version changed when enabling Split Tunneling | Split Tunneling requires IKEv2 | This is expected behavior: adjust the change window |
| One remote network does not route and another does | SA or route for that network misconfigured | Review that specific subnet with `ping` and `ip route` / `route print` |
### Conclusion
With these options you adapt the tunnel to the reality of the other end: IKEv2 whenever possible, and Split Tunneling when you want to manage each remote network on its own.
The practical rule is simple: prioritize IKEv2 for compatibility and stability, and reserve unified mode for when the remote equipment only knows how to work with a single SA.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.plenit.com/docs-en/productos/servers-1/how-to/ikev2-and-split-tunneling.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
