1

I have set up the ASA as VPN Server (SSL). Everything works great. I can reach every office network and also the Internet.

Now I noticed that on our old network, the configuration was different. When we connected over the old VPN (IPsec), and we browsed the Internet, we didn't use the tunnel to our router. We used the Internet of our Client.

In other words, we didn't appear with the outside IP address from the office router to the Internet, we appeared with our own IP address (from my home).

I googled, but I don't find the correct configuration tutorial. Maybe I'm looking wrong. What I need is Split tunneling.

Improve this question
3
  • As far as I know, Cisco VPNs do not allow split tunneling, and even actively remove that from your PC configuration if you add a route to do that on your PC. This is a security feature.
    – Ron Maupin ♦
    Jul 8, 2016 at 8:41
  • Really? That's sad, because we don't have a big bandwidth in our office and so every download goes through my VPN instead of my highspeed DLS at home ... but this would explain why I don't find a Guide for doing this.
    – SystemCookie
    Jul 8, 2016 at 8:45
  • 1
    It prevents you from setting up a backdoor to/from the office network and the public Internet, which which makes the office network vulnerable. If the network administrator sets up policies for controlled Internet access, split tunneling can be used to bypass the security and policies set up by the network administrator.
    – Ron Maupin ♦
    Jul 8, 2016 at 8:49

1 Answer 1

Reset to default
1

You can define an ACL and apply the ACL under the group policy using the split tunnel value command. You can then apply the group policy to the tunnel group.

It's explained in the documentation here:

http://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/119006-configure-anyconnect-00.html#anc13

Below will tunnel traffic only for the 10.10.0.0/16 network. 

access-list Split standard permit 10.10.0.0 255.255.0.0

group-policy ANYCONNECT-POLICY attributes
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value Split

tunnel-group ANYCONNECT general-attributes
 default-group-policy ANYCONNECT-POLICY

If you open your anyconnect client when connected and click the cog (advanced properties) and click on the route details tab you will see 10.10.0.0/16 as a secured route and 0.0.0.0/0 as an unsecured route.

Improve this answer
1
  • Thanks! Found this article before. Works like a charm :-)
    – SystemCookie
    Jul 15, 2016 at 11:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.