Anyconnect Split-Tunneling, allow only TCP/UDP Port 53 to DNS SRVs

[jokr]

Hi !

Given a Cisco ASA5508-x and the task to create an Anyconnect Connection Profile to allow Access to a single host within my Local LAN. No problem creating this profile. I added 2 internal DNS Servers for name resolution. The resulting Connection Profile created with the ASDM Anyconnect VPN Wizard creates a Profile with Access to the requested single host. This Profil/Group Policy also allows access to the 2 internal DNS Servers automatically. I would like to create an additional ACL somewhere to restrict access to the internal DNS Servers only for TCP/UDP Port 53.

Any hints where to add this additional restriction ?

[Marvin Rhoads · Accepted solution]

You can further add a vpn-filter to the connection so that you enforce the requested ports and protocols.

Here's an example: https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/99103-pix-asa-vpn-filter.html#anc6

[jokr]

yes, "vpn-filter" is the keyword to search for. Thanks.