How to disable always on vpn on selected clients (anyconnect client)?

[andersevang]

Hello there,

Does anyone know if its possible to set a password for disabling anyconnect always on vpn client on users pc, who do not have local admin rights?

Goal here is to have a last resort option for selected user clients to connect to internet if ASA FW is down or there are line problems to DC. Are there options for a selective user group to have the possibility to disable or temp go around always on vpn ? I would appreciate any solutions/suggestions

thank you

Regards,

Anders 

[Cristian Matei]

Hi,

    You can't use a password or other mechanism that allows the user to change the AnyConnect configuration, as it is stored in the AnyConnect XML profile.

    If you want a group of users, with Always on VPN enabled, to be able to still access network/internet resources if the VPN gateway is not reachable for whatever reason (so AnyConnect fails to connect), configure AnyConnect "Connect Failure Policy" to open. This will allow those users to work as like "Always on VPN" is disabled, but AnyConnect continuously tries to establish the VPN connection.

Regards,

Cristian Matei.