Hi,
Well there is atleast one way but this would require that the VPN Client usernames are configured on the ASA and not a separate AAA server.
So basically at the moment you have a "tunnel-group" , "group-policy" and "username" configurations for all the users and those configurations are done so that all users are using Split Tunnel which is configured under the "group-policy" that all the users share.
So to change the settings for a single user you can do the following
- Create and new "group-policy" on the ASA that is mostly identical to the one you already have for all of the users
- In this new "group-policy" instead of configuring Split Tunnel, configure it as Full Tunnel
- Lock the "group-policy" to the "tunnel-group" used
- Configure a new "username" for that user (or use an existing one)
- Under the configurations of that "username" attach the new "group-policy" under that username
- Lock this "username" also to the "tunnel-group"
When you connect with the new "username" that is using the newly created "group-policy", he/she will use Full Tunnel and everyone else will still keep on using their original "group-policy" configurations
I only quickly tested this with the old IPsec VPN Client but it should be usable with AnyConnect also
Here are some sample configuration. These naturally dont reflect a real life situation but just an example configuration related to using Split Tunnel or Full Tunnel
VPN Pool
ip local pool TESTI 10.100.100.1-10.100.100.10 mask 255.255.255.0
Split Tunnel ACL
access-list SPLIT-TUNNEL standard permit 10.0.0.0 255.255.255.0
Original Group Policy
group-policy TEST internal
group-policy TEST attributes
vpn-tunnel-protocol ikev1
group-lock value TEST
split-tunnel-policy tunnelspecified
split-tunnel-network-list value SPLIT-TUNNEL
Tunnel Group
tunnel-group TEST type remote-access
tunnel-group TEST general-attributes
address-pool TEST
default-group-policy TEST
tunnel-group TESTI ipsec-attributes
ikev1 pre-shared-key *****
Typical Username Configuration
username test password TaXO5ggjuKP7lCEW encrypted privilege 0
username test attributes
vpn-group-policy TEST
group-lock value TEST
service-type remote-access
User Specific Group Policy
group-policy FULL-TUNNEL internal
group-policy FULL-TUNNEL attributes
group-lock value TEST
split-tunnel-policy tunnelall
address-pools value TEST
New Username using Full Tunnel
username test2 password Gd7DkJmlJsKzP4fc encrypted privilege 0
username test2 attributes
vpn-group-policy FULL-TUNNEL
group-lock value TEST
service-type remote-access
As I said, the above configurations lack many basic settings like DNS servers, NAT configurations, etc
Hopefully this helps
Please remember to rate and/or mark the question as answered if it did.
Naturally ask more if needed
- Jouni
