Cisco AnyConnect - Management Tunnel with no User Tunnel

[Tony Greensmith]

Hello.

This is a fairly straight-forward question.  Is it possible to have a management tunnel profile without a user tunnel profile?  Or is it possible to have a management tunnel profile with a user tunnel profile but where the user tunnel profile is never auto initiated?

We are currently testing some configuration and have both a management and user tunnel profile setup.  The management tunnel establishes prior to Windows logon as expected, however once the user has logged in AnyConnect seems to want to auto initiate the user tunnel.  We do not want this behaviour.  We want the user to be able to choose when to establish the user tunnel, and shut it down when not needed (falling back to the management tunnel).

I cannot see anything detailing whether this is possible or not.  Any help appreciated.

[rschlayer]

Hi @Tony Greensmith 

normally the "auto connect" behaviour is configured in the AnyConnect Profile, check the trustet network connection settings in there.

"Trusted Network Detection (TND) gives you the ability to have AnyConnect automatically disconnect a VPN connection when the user is inside the corporate network (the trusted network) and start the VPN connection when the user is outside the corporate network (the untrusted network)."

See here https://www.cisco.com/c/en/us/td/docs/security/vpn_client/anyconnect/anyconnect41/administration/guide/b_AnyConnect_Administrator_Guide_4-1/configure-vpn.html#id_100236

BR
Rick

[Tony Greensmith]

Hi Rick,

Thanks for the response.  So auto connect is not enabled in the user profile, the management profile cannot have auto connect.  These are the TND settings in both the management and user profiles.  I believe that the management ones often override the user ones anyway.  They are pretty simple.

Any further thoughts appreciated.

[Abhijith M S]

Identical TND settings are recommended on both profiles. Please refer to CSCvu08033.