Ignore local proxy with AnyConnect VPN?

[andrewtrev]

Hi,

We have Cisco AnyConnect VPN deployed for remote connectivity to our corporate network. Whilst working on the corporate network we have the Windows 10 (IE) proxy settings configured by GPO. When connecting to the VPN, the proxy should not be used as this is inaccessible at this stage. If we disable the IE proxy, then the VPN can be established with no issue.

From reading the admin guide, it appears that this behaviour can be changed by setting VPN profile proxy settings to "IgnoreProxy" using the profile editor. This should "ignore the browser proxy settings on the user's computer" whilst establishing the tunnel. Setting this appears to make no difference for us and we still have to disable the proxy on the local pc. Are we missing something here?

[MHM Cisco World]

follow

[Aref Alsouqi]

Please try to go into the group policy attributes settings and issue the command "msie-proxy method no-proxy".

[andrewtrev]

Thanks for the response. Couple of questions though.

Will this disable the proxy prior to the VPN establishment phase? This is the critical bit as as we are using AnyConnect with Azure MFA vising SAML (I forgot to mention this!)  and the client needs to be able to access the authentication URLs which is not possible if the proxy is set.

Will the proxy remain disabled after the VPN has been established? This should not be the case as the corporate proxy settings are required once connected.

Basically we need to be able to disable the proxy temporarily whilst the VPN is being established only.

[Aref Alsouqi]

No it shouldn't as already mentioned. As those attributes are applied to the firewall group policy, they would live only during the connection lifetime, once the connection is ended, those attributes won't have any effect.

[Milos_Jovanovic]

Hi @andrewtrev,

I believe answer to your question is - no, it will not. You are applying group-policy upon successfull connection, not during one. After you get authenticated, you'll proceed with authoriyation in which you'll get no-proxy configuration.

IgnoreProxy option that you originally mentioned is meant to instruct AnyConnect not to use proxy while building the tunnel, but it doesn't state that it should bypass other dependent communication (such as SSO). Upon successfull connection, you can again push proxy settings via group-policy, for the tunneled connection.

One option that I see is that you create proxy exception for SSO page. You might get some issues with this, is same GPO is applied for both on and off-site users.

Another solution could be introduction of PAC file, and some logic behind it.

BR,

Milos