We need to run two Anyconnect VPNs one inside the other

[A00460610]

My organization uses AnyConnect as the only option to work remotly. We have a Cisco ASA inside the corporate network that gives access to another very protected subnetwork. When we are on the corporate network, we have no issue as we can launch a sigle Anyconnect client to connect to the subnetwork.

But when we work remotly the only work around that we have found is to connect our PC to the corporate VPN, launch a virtual windows 10 machine, and then launch a second anyconnect client to connect to our subnetwork. Any alternative suggestions?

This works, but it demands a lot of resources from our PCs + hyper-v issues. We have no control or access to eh corporate VPN infrastructure.

We've thought if we could use either another VPN client to connect to our subnetwork, or connect in some other way to our subnet. For security reasons VPN was selected as the way to connect (to our subnetwork) because each user receives a unique IP that can be traced, logged and monitored. 

[Marvin Rhoads]

You cannot do nested Anyconnect connections.

You could have a second profile on the primary VPN connection that only allows access to the protected environment and has the necessary restrictions built into it the same as the internal one. So when users authorized to access the restricted environment need to connect remotely they use that profile exclusively.

[A00460610]

Thank you for your answer, as I said we have no control over the corporate VPN (we are talking about a very large cooporation), so altering the first VPN or adding a new profile is not an option. I'm working on another solution with an alternate VPN client, I have posted the details here.

[A00460610]

Partially answering my own question. I installed Shrew VPN. I established the first VPN (corporate VPN) with Anyconnect and then used Shrew VPN to launch the second VPN, it worked!....but, the second VPN is not setting up the routes for interesting traffic. So it is connecting with the right IP address and all, but it is not capturing traffic that is supposed to go through that VPN...I'm trying to figure out why this is happening, or if I can set up the routes manually.