cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

Welcome to Cisco Firewalls Community


165
Views
0
Helpful
0
Replies
Highlighted
Enthusiast

Policy Routing for AnyConnect Clients based on Group

Hi -

We have a lab pod configuration that forces traffic to specific pod routers via PBR on our core switch.  When a user chooses a specific group when logging into AnyConnect, we apply a group-unique IP Pool, then enforce routing at the next hop.

While this is a functional configuration, it is cumbersome to maintain configuration at multiple hops on the routing path from user to lab pod.  We are looking for a way to simplify this through PBR only on the ASA.

Specifically, since AnyConnect automatically generates an RRI entry in the ASA routing table, it would stand to reason that I should be able to apply a route tag to the RRI entry based on the group used to connect.  So far, I can't find a way to do this.

The drawing below shows the basic idea where the firewall and pod routers are in the same network.

SampleNetwork.png

Ideas?

 

Thanks in advance!

PSC