cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
229
Views
0
Helpful
2
Replies
Highlighted
Beginner

AnyConnect - split tunnel configuration not working - 5508-X

Hi,

 

I have been working on setting up VPN split tunnel with AnyConnect but cannot get it working. I want to allow users to print locally so wanted to exclude printing related traffic from the tunnel by creating an ACL and using "excludespecified" option.

access-list AnyConnect_Client_Local_Print extended deny ip any4 any4 
access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq lpd 
access-list AnyConnect_Client_Local_Print remark IPP: Internet Printing Protocol
access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq 631 
access-list AnyConnect_Client_Local_Print remark Windows' printing port
access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq 9100 
access-list AnyConnect_Client_Local_Print remark mDNS: multicast DNS protocol
access-list AnyConnect_Client_Local_Print extended permit udp any4 host 224.0.0.251 eq 5353 
access-list AnyConnect_Client_Local_Print remark LLMNR: Link Local Multicast Name Resolution protocol
access-list AnyConnect_Client_Local_Print extended permit udp any4 host 224.0.0.252 eq 5355 
access-list AnyConnect_Client_Local_Print remark TCP/NetBIOS protocol
access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq 137 
access-list AnyConnect_Client_Local_Print extended permit udp any4 any4 eq netbios-ns 

group-policy SSLVPNAccess internal
group-policy SSLVPNAccess attributes
 vpn-idle-timeout 86400
 vpn-session-timeout 86400
 vpn-tunnel-protocol ssl-client ssl-clientless
 split-tunnel-policy excludespecified
 split-tunnel-network-list value AnyConnect_Client_Local_Print
 webvpn
  anyconnect mtu 1300
  anyconnect ssl keepalive 20
  anyconnect profiles value default type user
  anyconnect ask enable default anyconnect
tunnel-group SSLVPNAccess type remote-access
tunnel-group SSLVPNAccess general-attributes
 address-pool SSLVPNAccess
 authentication-server-group RADIUS LOCAL
 default-group-policy SSLVPNAccess
tunnel-group SSLVPNAccess webvpn-attributes
 group-alias SSLVPNAccess enable

I also added AnyConnect profile that allows local LAN access and enabled it on the client side as well.

Screen Shot 2020-04-09 at 6.49.00 AM.png

But despite that AnyConnect shows "tunnel all traffic" on the statistics tab and printing does not work obviously.

Screen Shot 2020-04-09 at 6.48.48 AM.png

Any comments will be appreciated.

Thanks!

 

 

 

2 REPLIES 2
Highlighted
Collaborator

Hi,

 

     Split-tunneling policy (ACL) needs to have IP statements, not TCP/UDP statements (because you can only have network routes, not TCP routes), and permit statements. If you want to allow users access to local lan, you would need your split-tunnelling ACL to have a single permit entry on "0.0.0.0/32". Find a configuration example here.

 

Regards,

Cristian Matei.

Highlighted

Hi Christian,

That is the guide I was following and before trying extended ACL I tried the standard one with "permit any4" as mentioned in the guide but the result was the same. Now I reverted the configuration back to the below but no luck.

access-list local_LAN standard permit any4

group-policy SSLVPNAccess attributes
 dns-server value 192.168.7.3 192.168.7.4
 vpn-idle-timeout 86400
 vpn-session-timeout 86400
 vpn-tunnel-protocol ssl-client ssl-clientless
 split-tunnel-policy excludespecified
 split-tunnel-network-list value local_LAN