I realize this topic is long buried, so not sure if this will be answered, but...
Might I inquire how you solved the routing issue, if at all? I'm running to the same issue OP is and we utilize a split-tunnel where the VPN is only for corporate access. We provide no internet access via VPN. In my testing I found that my Mac can ping other VPN-connected clients just fine, but cannot route further into the VPN network. However, if I had a route manually with our corporate network CIDR address routing works perfectly and I can get Kerberos SSO to work over the VPN.
Unfortunately the route is not persistent and will clear as soon as the VPN disconnects.
I found it odd that macOS doesn't seem to handle routing the same way that Windows clients do (our VPN is provided via Windows RRAS). When I check the routes between macOS and Windows clients they have identical VPN routes, yet the Windows client can seem to route fine over the VPN while macOS cannot. At least not without me adding the additional route.
