https://community.cisco.com/t5/network-security/how-to-remove-the-web-option-from-webvpn-ssl-vpn-tunnel/m-p/3939614#M30947 <P>Use the "keepout" command under webvpn. You can optionally present a message to users.</P> <P><A href="https://www.cisco.com/c/en/us/td/docs/security/asa/asa-command-reference/I-R/cmdref2/jk.html#pgfId-1630054" target="_blank">https://www.cisco.com/c/en/us/td/docs/security/asa/asa-command-reference/I-R/cmdref2/jk.html#pgfId-1630054</A></P> Sat, 12 Oct 2019 11:58:52 GMT Marvin Rhoads 2019-10-12T11:58:52Z https://community.cisco.com/t5/network-security/how-to-remove-the-web-option-from-webvpn-ssl-vpn-tunnel/m-p/3939539#M30946 <P>Hello,</P><P>&nbsp;</P><P>How can I remove the web login/portal-login feature, from the WebVPN/SSL-VPN, so users have no other option than connect through anyconnect client and not the web?</P><P>what command is missing in this template, and what command I shouldn't put?</P><PRE>ASA1(config)# <STRONG>webvpn</STRONG><BR />ASA1(config-webvpn)# <STRONG>anyconnect image flash:/anyconnect-03-k9.pkg<BR /></STRONG></PRE><PRE>ASA1(config-webvpn)# <STRONG>enable outside<BR /></STRONG></PRE><PRE>ASA1(config-webvpn)# <STRONG>anyconnect enable</STRONG></PRE><PRE>ASA1(config)# <STRONG>sysopt connection permit-vpn</STRONG></PRE><PRE>ASA1(config)# <STRONG>http redirect OUTSIDE 80</STRONG></PRE><PRE>ASA1(config)# <STRONG>ip local pool VPN_POOL 192.168.10.100-192.168.10.200 mask 255.255.255.0</STRONG></PRE><PRE>ASA1(config)# <STRONG>access-list SPLIT_TUNNEL standard permit 192.168.1.0 255.255.255.0</STRONG></PRE><PRE>ASA1(config)# <STRONG>group-policy ANYCONNECT_POLICY internal</STRONG> ASA1(config)# <STRONG>group-policy ANYCONNECT_POLICY attributes</STRONG> ASA1(config-group-policy)# <STRONG>vpn-tunnel-protocol ssl-client ssl-clientless</STRONG> ASA1(config-group-policy)# <STRONG>split-tunnel-policy tunnelspecified</STRONG> ASA1(config-group-policy)# <STRONG>split-tunnel-network-list value SPLIT_TUNNEL</STRONG> ASA1(config-group-policy)# <STRONG>dns-server value 8.8.8.8</STRONG> ASA1(config-group-policy)# <STRONG>webvpn</STRONG> ASA1(config-group-webvpn)# <STRONG>anyconnect keep-installer installed</STRONG> ASA1(config-group-webvpn)# <STRONG>anyconnect ask none default anyconnect</STRONG> ASA1(config-group-webvpn)# <STRONG>anyconnect dpd-interval client 30</STRONG></PRE><PRE>ASA1(config)# <STRONG>tunnel-group MY_TUNNEL type remote-access</STRONG> ASA1(config)# <STRONG>tunnel-group MY_TUNNEL general-attributes</STRONG> ASA1(config-tunnel-general)# <STRONG>default-group-policy ANYCONNECT_POLICY</STRONG> ASA1(config-tunnel-general)# <STRONG>address-pool VPN_POOL</STRONG> ASA1(config-tunnel-general)# <STRONG>exit</STRONG></PRE><PRE>ASA1(config)# <STRONG>tunnel-group MY_TUNNEL webvpn-attributes</STRONG> ASA1(config-tunnel-webvpn)# <STRONG>group-alias SSL_USERS enable</STRONG></PRE><PRE>ASA1(config)# <STRONG>webvpn</STRONG> ASA1(config-webvpn)# <STRONG>tunnel-group-list enable </STRONG></PRE><PRE>ASA1(config)# <STRONG>username SSL_USER password MY_PASSWORD</STRONG></PRE><PRE>ASA1(config)# <STRONG>username SSL_USER attributes</STRONG> ASA1(config-username)# <STRONG>service-type remote-access </STRONG></PRE><PRE> </PRE><P>&nbsp;</P><P>Thx</P> Sat, 12 Oct 2019 01:26:14 GMT https://community.cisco.com/t5/network-security/how-to-remove-the-web-option-from-webvpn-ssl-vpn-tunnel/m-p/3939539#M30946 George-Sl 2019-10-12T01:26:14Z https://community.cisco.com/t5/network-security/how-to-remove-the-web-option-from-webvpn-ssl-vpn-tunnel/m-p/3939614#M30947 <P>Use the "keepout" command under webvpn. You can optionally present a message to users.</P> <P><A href="https://www.cisco.com/c/en/us/td/docs/security/asa/asa-command-reference/I-R/cmdref2/jk.html#pgfId-1630054" target="_blank">https://www.cisco.com/c/en/us/td/docs/security/asa/asa-command-reference/I-R/cmdref2/jk.html#pgfId-1630054</A></P> Sat, 12 Oct 2019 11:58:52 GMT https://community.cisco.com/t5/network-security/how-to-remove-the-web-option-from-webvpn-ssl-vpn-tunnel/m-p/3939614#M30947 Marvin Rhoads 2019-10-12T11:58:52Z