1-54
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring Connection Profiles, Group Policies, and Users
Group Policies
hostname(config-group-policy)# dns-server value 10.10.10.15 10.10.10.30 2001:DB8::1
2001:DB8::2
hostname(config-group-policy)#
Step 3 If there is no default domain name specified in the DeafultDNS DNS server group, you must specify a
default domain. Use the domain name and top level domain for example, example.com.
asa4(config)# group-policy FirstGroup attributes
asa4(config-group-policy)# default-domain value example.com
asa4(config-group-policy)#
Step 4 Configure the DHCP network scope:
hostname(config-group-policy)# dhcp-network-scope {ip_address | none}
hostname(config-group-policy)#
DHCP scope specifies the range of IP addresses (that is, a subnetwork) that the ASA DHCP server
should use to assign addresses to users of this group policy.
The following example shows how to set an IP subnetwork of 10.10.85.0 (specifying the address range
of 10.10.85.0 through 10.10.85.255) for the group policy named First Group:
hostname(config)# group-policy FirstGroup attributes
hostname(config-group-policy)# dhcp-network-scope 10.10.85.0
Configuring Split-Tunneling Attributes for Group Policies
Split tunneling lets a remote-access client conditionally direct packets over a VPN tunnel in encrypted
form or to a network interface in clear text form. With split tunneling enabled, packets not bound for
destinations on the other side of the tunnel do not have to be encrypted, sent across the tunnel, decrypted,
and then routed to a final destination. The split-tunnel-policy command applies this split tunneling
policy to a specific network.
Differences in Client Split Tunneling Behavior for Traffic within the Subnet
The AnyConnect client and the legacy Cisco VPN client (the IPsec/IKEv1 client) behave differently
when passing traffic to sites within the same subnet as the IP address assigned by the ASA. With
AnyConnect, the client passes traffic to all sites specified in the split tunneling policy you configured,
and to all sites that fall within the same subnet as the IP address assigned by the ASA. For example, if
the IP address assigned by the ASA is 10.1.1.1 with a mask of 255.0.0.0, the endpoint device passes all
traffic destined to 10.0.0.0/8, regardless of the split tunneling policy.
By contrast, the legacy Cisco VPN client only passes traffic to addresses specified by the split-tunneling
policy, regardless of the subnet assigned to the client.
Therefore, use a netmask for the assigned IP address that properly references the expected local subnet.
Setting the Split-Tunneling Policy
Set the rules for tunneling traffic by specifying the split-tunneling policy for IPv4 traffic:
hostname(config-group-policy)# split-tunnel-policy {tunnelall | tunnelspecified |
excludespecified}
hostname(config-group-policy)# no split-tunnel-policy
To Next Page
Loading...
Need help?
General
