VPN connects but internal applications are unreachable

Usually split-tunnel routing or DNS, not the tunnel itself.

1. Confirm the tunnel is up and note the assigned VPN IP.
2. Ping the application by IP. If the IP works but the name does not, it is DNS — check that the VPN profile pushes the internal DNS suffix and servers.
3. If the IP also fails, check that the destination subnet is in the split-tunnel include list.
4. Verify the firewall policy permits the VPN pool to reach that subnet.

Collect the output of ipconfig /all (or ifconfig), a traceroute to the application IP, and the VPN client log before raising a ticket.