AnyConnect VPN flexibility

[James Nowotny]

I have setup an ASA-5515 with 9.1(2).  I have VPN setup with users using AnyConnect.  Everything is working well.  I now have a couple new requirements that I'm not sure how to setup or if they are even possible.

1)  Can I setup the VPN so a user can pick whether or not they are using split tunnel.  We have a couple of engineers that go to China and need to use the VPN so that in addition to the normal access, that can use the VPN for regular Internet access bypassing the China filters.  I think this mean I also have to setup a hairpin in the ASA.  But I only want this when needed.

2)  Can I setup the VPN so it will work from our Guest network which is also on the same ASA.

Thanks...Jim

[Marcin Latosiewicz · Accepted solution]

Jim, 

My info might be off by some two years, but...

Ad1. Would require to setup a separate tunnel-group or assign different parameters via DAP/RADIUS/whatever, including a different IP address pool if you want to do hair pinning for some traffic. That's probably the "easiest" way. 

Ad2. Couple of challenges. Yes, you can enable anyconnect service on multiple interface, not only outside. Think about traffic flow though. Due to architectural choices of ASA (at least they were in place two years back) you will not be able to communicate  _with_ ASA on a different interface than you're on right now,  with the exception of managment-access. So you'd need to enable the anyconnect service on the interface facing guest network. This move also comes with a DNS challenge, when called from guest network for DNS A record of myasa.mycompany.tld , you should return the guest network IP. 

Hope that makes sense :]

M.