Cisco Anyconnect VPN Group Policy and Connection profiles

[Craddockc]

Community,

I have a question regarding the group policies in the ASA for Anyconnect clients. How does the ASA decide which connection profile it will use for a certain VPN connection being established? For instance if I have two connection profiles set up, and a user connects with Anyconnect (or any other VPN supplicant), how does the ASA decide which connection profile to use, and subsequent Group Policies to use?

Thanks.

[Rahul Govindan · Accepted solution]

If you do not have any special config on the ASA, the AnyConnect connection will always fall into the DefaultWebvpnGroup, even if you have multiple other groups defined.
You can have the user fall into another tunnel-group (connection profile) using the following mechanisms:
1) Create a group-url for a new tunnel-group and have user go directly to that URL.
2) Enable tunnel-group-list so that the user can chose between multiple groups (alias needs to be defined for it to show up in the list)
3) Use some sort of certificate to tunnel-group mapping for Cert auth connection profiles.

This list may not be exhaustive, just the ones that I could recall.
For group-policy, you can use AAA or local user attributes to assign a group-policy to the user. If those don't exist, the default-group-policy setting from the matched tunnel-group is chosen

[Craddockc]

Rahul,

Thank you! This was very helpful. I was able to create a new tunnel group and alias it with an intuitive name. The options are then presented before login by the Anyconnect client!

Thanks!