Thanks Jinto, They said that's exactly what they were looking for... Thanks Again! -Matt ... View more

Hey Prashant, thanks for the reply! Ok, thanks for verifying this for me. I'll make my changes either off-hours, or once no more "Guest" are connected to that WLAN. Thanks Again, Matt ... View more

Hey Rahul, thanks again for the reply, very much appreciated! Ok, that does sound like its the same problem. Our version is only slightly different, but close enough. ASA v9.4(1) and ASDM v7.4(1). Thanks Again, Matt ... View more

Hey Rahul, thanks for the reply. We have Cisco ISE integrated with the ASA for VPN access. And we are doing CoA for when clients authenticate and become compliant, then they receive a dACL from ISE. So maybe that's why? Thanks Again, Matt ... View more

That's correct. But, this was suggested to make this change to the Split-Tunnel ACL because of a ISE Posture issue that we seem to be having via VPN. TAC suggested I add that "Deny" statement to the top of our Split-Tunnel ACL, which they sited the following quote below: New Split Include Tunnel Behavior (CSCum90946) Formerly, if a split-include network was a Supernet of a Local Subnet, the local subnet traffic was not tunneled unless a split-include network that exactly matches the Local Subnet was configured. With the resolution of CSCum90946, when a split-include network is a Supernet of a Local Subnet, the Local Subnet traffic is tunneled, unless a split-include (deny 0.0.0.0/32 or ::/128) is also configured in the access-list (ACE/ACL). The new behavior requires the following configurations when a Supernet is configured in the split-include and the desired behavior is to allow LocalLan access:     access-list (ACE/ACL) must include both a permit action for the Supernet and a deny action for 0.0.0.0/32 or ::/128.     Enable Local LAN Access in the AnyConnect profile (in the Preferences Part 1 menu of the profile editor. (You also have the option to make it user controllable.)     Thanks Again, Matt ... View more