Override split vpn setting for Anyconnect on local machine

[frank_chang]

Hi there,

My company deployed Cisco ASA and AnyConnect as remote access solution with split vpn setting so only traffic to Intranet resource will pass through the tunnel while Internet access still via local broadband.

I wonder if there's anyway I can modify some local setting on AnyConnect so I can route all traffic via the tunnel to Intranet first, then for Internet traffic it can utilize corporate proxy to go out again.

I tried to change default route on DOS prompt when VPN's up but seems not work.

Any suggestion on this?

Thanks

Frank

[Marvin Rhoads · Accepted solution]

No you cannot do that from the client PC. It has to be done at the ASA. Otherwise it would enable end users to choose security policy independent of what the organization has mandated.

The ASA admin can make multiple profiles so that the user can choose between one type or another - or require certain users to use split VPN and others to not do so.

[frank_chang]

Hi Marvin,

Thanks for the reply.

Understood, it fully makes sense that user shouldn't be able to override the corporate policy, otherwise there'll be severe potential risk. Just wonder if there's any workaround. So seems no.

Thanks again.

Frank

[Marvin Rhoads]

You're welcome. Please mark your question as answered if it has been.

p.s. I have seen one "workaround - if you can call it that - run the VPN from within a VM on the client PC. Something like Windows running in VMware workstation on a Windows PC.

Obviously it's not for the everyday user, but we use this in lab or training environments sometimes to do demonstrations while not losing the ability to see what's going on from the point of view of the demo PC.