Hi awesome community!
We have a bit of a challenge at the moment with our remote access VPN. Our setup is an always-on VPN using AnyConnect (cert based authentication) and we’re also using a management tunnel for pre-logon functionality. The tunnel itself is a split-tunnel exclude (for certain public IP ranges) and a dynamic exclude for cloud based apps like Webex. The desire from our business is that we then tunnel the rest of the traffic through the VPN to gain access to our network and also wash internet filtering through internal web-filters (requiring a default route within the client connection).
All this works A-OK, however.... we work with another company who has given us a VPN client (non-Cisco) to connect to their services, so the ask from my business is can we allow my users to connect to two VPN’s at the same time. I’ve had a brief look at this and while we can split tunnel out the public IP’s of their VPN peers, the client connects but AnyConnect owns the routes and connectivity to the third party doesn’t work. The third party does not want to configure any lan>lan access and mandates that all traffic must come over the client VPN. We would prefer that users could not disconnect from our VPN. Is there a workable solution here that will keep everyone happy?
Thanks in advance!
