2

Right now I have Remote Access VPN configured to use fulltunnel. Right now when I am off the VPN I can still browse external sites (google, yahoo, etc) which is using my local ISP. If I want to VPN into my network, I need to open up Cisco Anyconnect desktop client and enter the vpn URL and my credentials. Once I am connected all my traffic is going through my companies ISP circuit/ASA firewall.

Is there a way to force VPN on a Cisco ASA firewall so a user can not use their computer unless they are VPN into company network? Meaning as soon as they log on they can not browse the internet or get to email until they VPN into network.

Meaning, is there a setting in ASA that tells it to connect to VPN automatically when there is an internet connection?

Any information would be most helpful.

Thanks,

Improve this question
7
  • Meaning, is there a setting in ASA that tells it to connect to VPN automatically when there is an internet connection?
    – Graham
    Aug 8, 2017 at 16:01
  • Have a look at the "always on" feature : cisco.com/c/en/us/td/docs/security/vpn_client/anyconnect/…
    – hertitu
    Aug 11, 2017 at 0:04
  • @hertitu, that doesn't control the computer when it is not connected to the ASA, and that is the question. The question asks how to prevent the computer from accessing the Internet when not connected, but then the PC could not connect to the ASA in the first place.
    – Ron Maupin ♦
    Aug 11, 2017 at 13:50
  • @RonMaupin it does control the computer when it is not connected, it only allows a connection to the ASA and nothing else.
    – hertitu
    Aug 11, 2017 at 21:34
  • The ASA will even edit the any connect software by editing the ASA. The host computer doesn't need direct editing at all. No GPOs. It's automatic when they connect. Then after that the Cisco software does the job. It's pretty slick. You can have it start when the host logs into the computer automatically as well. No editing the host. All done from the ASA.
    – Fixitrod
    Aug 11, 2017 at 22:24

1 Answer 1

Reset to default
2

Yes, it can.

The Anyconnect VPN client has a feature named "Always On":

Always-On operation prevents access to Internet resources when the computer is not on a trusted network, unless a VPN session is active. Enforcing the VPN to always be on in this situation protects the computer from security threats.

Cisco documentation: Require VPN Connections Using Always-On

Note that this feature is configured in the Anyconnect client profile, which can either be pre-deployed or pushed from the ASA. Obviously, if you want the feature to be active from day zero, even before the user makes his first VPN connection, then you need to pre-deploy the profile.

Also note that the comments mentioned concerns about the user being able to circumvent this feature by defining their home (or coffee shop) network as "trusted" in the Windows firewall settings. Anyconnect does not use the Windows firewall settings for trusted networks. Instead it uses another Anyconnect feature named Trusted Network Detection (TND) feature which allows the ASA admin to control which networks are considered trusted based on the DNS settings of the client.

cfr. Configure Trusted Network Detection

Improve this answer
2
  • 2
    Even if host configuration is off-topic here, it is worth noting that it's quite easy to undermine with administrative privilege on the machine, and it's also quite easy to gain administrative privilege on most operating systems. This kind of policy need a well-hardened O.S. to be effective.
    – JFL
    Aug 14, 2017 at 13:38
  • I think if a user goes through that trouble it's time to have a serious discussion! Thanks for the info on the trusted domain hertitu. Great info
    – Fixitrod
    Aug 14, 2017 at 14:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.