Restrict AnyConnect to only specific VPN headend

[peter.matuska1]

Hi,

the task is simple. Is it possible to use anyconnect VPN only with predefined VPN concentrators? So the users cannot type its own remote IP where they would like to connect.

thank you

[Rob Ingram]

Hi,

Yes you can restrict this. You need to disable "Allow Manual Host Input", this is enabled as default. You can either use the AnyConnect Profile Editor or alternatively modify the XML configuration file manually, and change true to false

C:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client\Profile\

    <AllowManualHostInput>true</AllowManualHostInput>

HTH

[peter.matuska1]

hi, great, this helps. And how about the vpncli.exe? I tried it and it worked.

thank you

[Rob Ingram]

Hi,
That's a good question....the only thing I can think of, is perhaps restricting the execution of the vpncli.exe file via a GPO in AD. I've not read any cisco documentation that indicates a way to stop the use of the application.

HTH

[balaji.bandi]

Create Any Connect profile and push to client.

https://www.cisco.com/c/en/us/td/docs/security/vpn_client/anyconnect/anyconnect40/administration/guide/b_AnyConnect_Administrator_Guide_4-0/anyconnect-profile-editor.html