tunnel-group mapping

[Junnan Wu]

Hi guys,

I currently have one ASA configured with two tunnel-group - both using username and certificate authentication for AnyConnect users. this is working well. My question is what if there is another requirement for external users to be authenticated only by local username and password?  It seems I have to create one more tunnel-group with local authentication. if that is the case, how ASA determine which tunnel-group to use?

thank you

[Karsten Iwen]

The easiest way is to configure a group-URL inside the tunnel group. The user enters this tunnel-group-specific URL in Anyconnect and lands on the right Tunnel-group.