Give vendor access to their local network when on our AnyConnect

[Travis-Fleming]

Hello,

We added a vender group-policy and whenever the vendor joins our VPN they are not able to access their own local resources on their local network. Below is the policy I have setup. I was under the understanding with the "split-tunnel-policy tunnelspecified" command it would only send the networks specified in the split-tunnel-network-list down the VPN, they could then have access to their own local network. Can someone provide some clarity on this? From what I have setup, I believe it should only send traffic for 172.16.1.166 down the VPN, and any other traffic from their PC would be offloaded locally?

I also had them open their AnyConnect client, go to preferences, and check the box to allow access to LAN.

group-policy GroupPolicy-vendor-Access internal
group-policy GroupPolicy-vendor-Access attributes
wins-server none
dns-server value 172.16.1.160 172.16.1.161
vpn-filter value vpn-vendor-permit
vpn-tunnel-protocol ssl-client ssl-clientless
split-tunnel-policy tunnelspecified
split-tunnel-network-list value vpn-vendor-split-tunnel
default-domain value XYZ.com

!

access-list vpn-vendor-permit extended permit tcp 10.20.0.0 255.255.252.0 host 172.16.1.166 eq 3389

access-list vpn-vendor-split-tunnel standard permit host 172.16.1.166

[Rob Ingram]

Hi @Travis-Fleming 

Your ACL need to permit to host 0.0.0.0, such as this:-

access-list ALL_EXCEPT permit host 0.0.0.0

Example here

[Travis-Fleming]

I read that on a few Cisco support sites, but it didn't make sense to me. Wouldn't that send all traffic down the tunnel if I'm using the "tunnelspecified" command? Maybe you could explain to me like I'm a kindergartener.

[Travis-Fleming]

And would it just be:

access-list vpn-vendor-split-tunnel standard permit host 172.16.1.166
access-list vpn-vendor-split-tunnel standard permit host 0.0.0.0

Or would I just have:

access-list vpn-vendor-split-tunnel standard permit host 0.0.0.0

[Rob Ingram]

@Travis-Fleming sorry, you are doing tunnelspecified not excludespecified. So if you only specify the 1 destination any other traffic should not be encrypted and sent via anyconnect. On AnyConnect what is the output of the secured and non-secured routes?

[Travis-Fleming]

Here is what I see from my end when I connect with that group-policy. Waiting on my vender to supply the same screencap. All the individual IP's in the secured routes section I do have spelled out in my access list.

[Travis-Fleming · Accepted solution]

What I had was working. The Vendor mis-spoke when they talked to me about what they could and could not access. This was working as is. Darn miscommunication from the vendor.