Anyconnect Questions

[Ed Willson]

I'm trying to move away from the IPSEC VPN Client to the Anyconnect client. I've got two big question topics that I need answered:

1: I'd like to explore the always on VPN. Is that included with the essentials licence, or is it an add-on? Also what happens when a user logs on and has no internet connection? Will it prompt to connect directly after they connect to something?

2: Login scripts - Can the Anyconnect client run a script post connection? Currently they (users) are doing this manually, and many don't bother.

Bonus Question: Currently the VPN access is a split tunnel, so internet traffic is un-filtered off-site. How loud did the users scream when you went from a split tunnel to fully tunneled?

Thanks,

    Taemyks

[Jennifer Halim · Accepted solution]

Here is more information on "Always-on" feature:

http://www.cisco.com/en/US/docs/security/vpn_client/anyconnect/anyconnect31/administration/guide/ac03vpn.html#wp1205144

1. Always on VPN requires either AnyConnect Essentials + secure Mobility license, OR/ Premium license:

http://www.cisco.com/en/US/docs/security/vpn_client/anyconnect/anyconnect31/feature/guide/anyconnect31features.html#wp58017

2. Yes, more information as follows:

http://www.cisco.com/en/US/docs/security/vpn_client/anyconnect/anyconnect31/administration/guide/ac03vpn.html#wp1068902

Bonus question:

it really depends on how busy your VPN headend (ASA) site is, and remember that depending on where the user is, all traffic will traverse all the way back to headend to internet, back to headend, and gets encrypted back to the vpn client. If users are going overseas, that would impact the most normally. But it really again depends on how busy your VPN server is.

Hope this helps.

[Ed Willson]

Proper answer. Thanks! I got pricing back for the premium license and choked. I was looking at the shared rather than primary.

I went with essentials instead and am writing a (windows) service that monitors connections and adjusts firewall rules to make the client act like it's always on.

Thanks,

   Taemyks