- Introduction:
- AnyConnect settings to help alleviate that increased load
- Local Lan Access
- Local LAN Access Demo - UX
- Configuring Local LAN Access
- Split Tunneling
- Split Tunneling Demo - UX
- Split Tunneling Configuration
- Dynamic Split Tunneling
- Dynamic Split Tunnel Exclude
- Dynamic Split Exclude Demo - UX
- Dynamic Split Tunneling Exclude Configuration
- Dynamic Split Tunnel Include
- Dynamic Split Include Demo - UX
- Dynamic Split Include Configuration
- Enhanced Dynamic Split Tunneling
- Enhanced DST Exclude Demo - UX
- Enhanced DST Exclude Configuration
- Enhanced DST Include Demo - UX
- Enhanced DST Include Configuration
Introduction:
This article was created due to the COVID-19 pandemic
Cisco does not normally provide specific guidance around how you should design your VPN. AnyConnect and ASA Remote Access VPN (RA-VPN) is very powerful with a lot of configuration options to help your organization deploy in whatever way that best fits your needs. In response to the COVID-19 global pandemic, where customers are moving to 100% remote-access, and combining that with 100% virtual meetings (i.e.:WebEx), Cisco is breaking with tradition and providing some best-practice guidance for RA-VPN design.
Cisco's guidance, especially in this time of global response, is to use Dynamic Split Tunneling to exclude the DNS names related to real-time communication software as a service (SaaS) tools, such as WebEx.
Please see the blog written by Aaron Woland regarding DST Best Practices.
Dynamic Split Tunneling – a COVID-19 Best Practice
Note: This article covers all forms of Split tunneling, including Dynamic Split Tunneling (DST) for your education and guidance.
Due to the COVID-19 global pandemic, Cisco customers are increasing AnyConnect licenses to allow a surge of AnyConnect sessions to their current headend ASA/Firepower. Link to Cisco's Free Offers for COVID-19 Pandemic.
Items of Note for the free AnyConnect Licenses:
- You are limited to the maximum VPN sessions supported by the head-end and not AnyConnect.
- In many cases, customers are adding or repurposing existing hardware to increase the capacity in their VPN head-ends.
Thanks to most organizations moving to a 100% employee work-from-home, there is tremendous increased in the load on the internet gateways. Bandwidth is one of the implications of a sudden increase in AnyConnect sessions.
AnyConnect settings to help alleviate that increased load
Allow Local LAN Access
Split Tunneling
Dynamic Split Tunneling
Dynamic Split Tunneling (DST) provides the ability to define domains that will be either included or excluded dynamically after the user resolves the domain using DNS. This functionality occurs after the tunnel has been established and the non-secure and secure routes are adjusted accordingly based on the Administrators configuration.
Split tunnel traffic based on domain
A good example would be to exclude traffic to SaaS services dynamically based on DNS resolution, so traffic destined to SaaS goes directly to the service, instead of through the tunnel. Originally released with AC 4.5 and Enhanced In AC 4.6
AnyConnect 4.5.00058 New Features
AnyConnect 4.6.00362 New Features
ASA v9.0 >. required
Local Lan Access
Note: This is more for user convenience, rather than a bandwidth saver.
In an exclude-specified configuration; AnyConnect will not tunnel traffic to or from the networks specified in the Network List. Traffic from or to all other addresses is tunneled.
The VPN client profile that is active on the client must have Local LAN Access enabled. If the Administrator has configured the Local LAN Access setting to be User-Controllable the user will then have the ability to toggle this functionality Off/On using the Preferences tab in the AnyConnect UI. To avoid this scenario simply uncheck User-Controllable in the profile to ensure Local LAN Access is always available.
Demo exclude users home RFC1918 address space from VPN
Local LAN Access Demo - UX
Configuring Local LAN Access
Local LAN ASDM Configuration Group-Policy
Local LAN ASDM Configuration – Access List
AnyConnect Client Profile – Local LAN Access
The AnyConnect Client profile is an XML file that is present on the end users device. The configured profile on the head-end will always be pushed to the end user if the the head-end determines during session establishment that the user does not have the most current or correct profile.
The AnyConnect Client Profile (VPN) is applied to the group-policy on the head-end or. placed manually by the Administrator using a software management solution. This profile controls most AnyConnect VPN features; Local LAN Access being one of them.
Split Tunneling
Background:
AnyConnect by default will send (secure) all traffic over the tunnel if not specifically configured to do otherwise and
although secure, a possible problem doing so is the high consumption of bandwidth with the routing of the user's traffic back to internet and SaaS resources.
Solution:
Split Tunneling as mentioned earlier is a method of selectively designating traffic based on traditional IPv4/IPv6 networks or Dynamically based on domains to either be excluded or included in the secure tunnel. This will reduce the consumption of bandwidth.
Two types of Split Tunneling:
Split Tunneling innclude/Tunnel specified
A tunnel-specified configurations tunnels all traffic to or from the networks specified in the Network List through the tunnel. Data to all other addresses travels in the clear.
Split Tunneling Demo - UX
Split Tunneling Configuration
Split Tunnel Include
ASDM Configuration – Group-Policy
Configured in the Group-Policy Advanced section
Split Tunnel
ASDM Configuration – Access List
Dynamic Split Tunneling
Dynamic Split Tunnel Exclude
The Dynamic-Split-Exclude-Domains configuration will dynamically provision split exclude tunneling after tunnel establishment, based on the host DNS domain name
AnyConnect will exclude the list of domains from the secure vpn tunnel and all other traffic will be sent over the secure VPN tunnel.
Dynamic Split Exclude Demo - UX
Dynamic Split Tunneling Exclude Configuration
ASDM Configuration – Attribute Type
Enable dynamic split tunneling
Create a custom attribute type of dynamic-split-exclude-domains
This attribute type instructs AnyConnect to exclude any DNS names included in a dynamic-split-exclude list from being tunneled through the VPN.
Dynamic Split Tunnel Exclude
ASDM Configuration – Attribute Name
This is the list of DNS names to exclude from the VPN tunnel
This configuration can be applied to either a Group-Policy or a Dynamic Access Policy
Dynamic Split Tunnel Exclude
ASDM Configuration – Group Policy
Dynamic Split Tunnel Exclude
ASDM Configuration – Dynamic Access Policy (DAP)
Custom attributes are sent to and used by the AnyConnect client to configure features such as Deferred Upgrade, PerApp VPN and Dynamic Split Tunneling. A custom attribute has a type and a named value.
Dynamic Split Tunnel Include
Another option is to configure Dynamic-Split Include-Domains. This is the opposite behavior shown when using the previous dynamic-split-exclude-domains configuration. AnyConnect will send only the domains listed in the configuration over the secure vpn tunnel and all other traffic will be sent in the clear.
Dynamic Split Include Demo - UX
Dynamic Split Include Configuration
ASDM Configuration – Attribute Type
Creating this custom attribute, you can dynamically split include traffic after tunnel establishment
Based on the host DNS domain name. By adding dynamic-split-include-domains attribute
dynamic split include requires at least one static split include network, a single IP address would do, e.g. one of the DNS servers pushed to client.
Dynamic Split Tunnel Include
ASDM Configuration – Attribute Name
This configuration can be applied to either a Group-Policy or a Dynamic Access Policy.
Enter the domains, use comma separated values
The domains listed here and associated with the attribute Dynamic-split-Include-domains will traverse the tunnel after DNS resolution.
Dynamic Split Tunnel Include
ASDM Configuration – Group-Policy
Dynamic Split Tunnel Include
ASDM Configuration – Static Split Include Network
Dynamic split include requires at least one static split include network,
A single IP address would do, e.g. one of the DNS servers pushed to client.
Dynamic Split Tunnel Exclude
ASDM Configuration – Dynamic Access Policy (DAP)
Custom attributes are sent to and used by the AnyConnect client to configure features such as Deferred Upgrade, PerApp VPN and Dynamic Split Tunneling. A custom attribute has a type and a named value.
Enhanced Dynamic Split Tunneling
Enhanced Dynamic Split Tunnel Exclude
When dynamic split exclude tunneling is configured with both split exclude and split include domains, in order for traffic to be dynamically excluded from the tunnel it must match at least one dynamic split exclude domain and no dynamic split include domains.
- Supported in AnyConnect v4.6 >
Simple Use Case:
Customer needs to exclude traffic to google.com from the vpn tunnel however they need traffic to specific google domains i.e; edu.google.com and classroom.google.com to traverse the vpn tunnel
Enhanced DST Exclude Demo - UX
Demo
DST Exclude: google.com
DST Include: edu.google.com,classroom.google.com
Enhanced DST Exclude Configuration
Enhanced Dynamic Split Tunnel Exclude - ASDM Configuration – Attribute Type
Enable dynamic split tunneling
Create a custom attribute type of dynamic-split-exclude-domains and dynamic-split-split-include-domains
The attribute-types and the associated attribute-names instruct AnyConnect on what is excluded from or included in the Secure
Tunnel.
Dynamic Split Tunnel Exclude - ASDM Configuration – Attribute Name
This is the list of domain names to exclude from the VPN tunnel
Note: This would typically be an extensive Comma-delimited list of domains.
This configuration can be applied to either a Group-Policy or a Dynamic Access Policy.
Dynamic Split Tunnel Include - ASDM Configuration – Attribute Name
This configuration can be applied to either a Group-Policy or a Dynamic Access Policy.
Enter the domains, use comma separated values
The domains listed here and associated with the attribute Dynamic-split-Include-domains will traverse the tunnel after DNS resolution.
Dynamic Split Tunnel Exclude - ASDM Configuration – Group-Policy
Dynamic Split Tunnel Include - ASDM Configuration – Group-Policy
Dynamic Split Tunnel (aka: SplitDNS) - ASDM Configuration – Group-Policy cont..
Dynamic Split Tunnel Exclude & Include - ASDM Configuration – Dynamic Access Policy
Custom attributes are sent to and used by the AnyConnect client to configure features such as Deferred Upgrade, PerApp VPN and Dynamic Split Tunneling.
A custom attribute has a type and a named value.
In this Use Case both Exclude and Include configurations are applied.
Enhanced Dynamic Split Include Tunneling
When dynamic split include tunneling is configured with both dynamic split-include and dynamic split-exclude domains, traffic that is marked to be included in the tunnel must match at least one of the dynamic-split-Include-domains but must not match any dynamic-split-exclude domains.
Supported in AnyConnect v4.6 >
Simple Use Case:
Customer needs to exclude traffic to edu.google.com and classroom.google.com from the vpn tunnel however they need traffic to all other google domains to traverse the vpntunnel (Included)
Enhanced DST Include Demo - UX
DST Exclude:
edu.google.com
classroom.google.com
DST Include:
google.com
Note: 0.0.0.0/0 Non-Secure Routes would indicate the DST Excluded domains configured as well as all other domains would be sent in the clear and not shown specifically in the UI
Enhanced DST Include Configuration
ASDM Configuration - Enhanced DST Include
The only difference here is in the Attribute names list
Configuration > Remote Access VPN > Network (Client) Access > Advanced > AnyConnect Custom Attribute Names
Note:
Please refer to previous Use Case “Enhanced DST Exclude” for all other ASDM Configuration guidance.
</Carco>
