Step 1

Create the deploy-once/append FlexConfig object that creates the dynamic split tunneling custom attribute and assigns to the attribute the domain names that should be excluded from the VPN tunnel and instead be sent over the public Internet.

1. Choose Objects > Object Management.

2. Choose FlexConfig > FlexConfig Object from the table of contents.

3. Click Add FlexConfig Object, configure the following properties, and click Save.

   • Name—The object name. For example, Enable_Dynamic_Split_Tunnel.

   • Deployment—Select Once. These commands need to be configured one time.

   • Type—Keep the default, Append. The commands are sent to the device after the commands for directly-supported features.

   • Object body—In the object body, type the commands needed to create an attribute of the type dynamic-split-exclude-domains, then add the data, which is an attribute name and a list of the domain names to exclude. For example, to create an attribute named excludeddomains, and to exclude the webex.com and ciscospark.com domains, the commands would be the following. Note that the description is optional, but if included, it is not a separate command but part of the anyconnect-custom-attr command. For the domain names, separate them with a comma but do not include spaces.

     
     webvpn 
      anyconnect-custom-attr dynamic-split-exclude-domains description traffic for these domains will not be sent to the VPN headend 
      anyconnect-custom-data dynamic-split-exclude-domains excludeddomains webex.com,ciscospark.com
     

   The object should look similar to the following:

   
   

   

   
   

Step 2

(Recommended.) If you use custom group policies, create a deploy-once/append FlexConfig object to configure the dynamic split tunnel custom attribute in the group policies.

The system will not negate changes you make to custom group policies, so you need to deploy the changes once. If you use multiple group policies, you could use a single FlexConfig object to add the custom attribute to each policy in turn. Alternatively, you could create one FlexConfig object per group policy. The outcome will be the same, so the choice is based on your own requirements for modularizing your FlexConfig policy.

On the FlexConfig Objects page, click Add FlexConfig Object, configure the following properties, and click Save.

• Name—The object name. For example, Add_Dynamic_Split_Tunnel_Sales.

• Deployment—Select Once.

• Type—Keep the default, Append.

• Object body—In the object body, type the commands needed to add the custom attribute to the group policy. For example, if the attribute you created is named excludeddomains, and the group policy is named “sales,” the commands are:

  
  group-policy sales attributes 
   anyconnect-custom dynamic-split-exclude-domains value excludeddomains 
  

The object should look similar to the following:

Step 3

(Not recommended.) If you use the default group policy, named DfltGrpPolicy, create a deploy-everytime/append FlexConfig object to configure the dynamic split tunnel custom attribute in the group policy.

You must deploy this object every time, because on each deployment, the system will negate any custom changes to the default policy.

We recommend that you create custom group policies rather than use DfltGroupPolicy.

On the FlexConfig Objects page, click Add FlexConfig Object, configure the following properties, and click Save.

• Name—The object name. For example, Add_Dynamic_Split_Tunnel_DfltGrpPolicy.

• Deployment—Select Everytime. These commands need to be configured one time.

• Type—Keep the default, Append. The command must be sent after the system negates custom attributes in the default group policy.

• Object body—In the object body, type the commands needed to add the custom attribute to the group policy. For example, if the attribute you created is named excludeddomains, the commands are:

  
  group-policy DfltGrpPolicy attributes 
   anyconnect-custom dynamic-split-exclude-domains value excludeddomains 
  

The object should look similar to the following:

Step 4

Create the FlexConfig policy that deploys these objects.

1. Choose Devices > FlexConfig.

2. Either click New Policy, or if an existing FlexConfig policy should be assigned to (or is already assigned to) the target devices, simply edit that policy.

   When creating a new policy, assign the target devices to the policy in the dialog box where you name the policy.

3. Use Ctrl+Click to select the FlexConfig objects in the User Defined folder in the table of contents and click > to add them to the policy.

   The objects should be added to the Selected Appended FlexConfigs list.

4. Use drag and drop to ensure that the objects are in the correct order.

   The object that creates the custom attribute object must come before the objects that assign that attribute to the group policies. Otherwise, if you try to add a custom attribute that does not yet exist, you will get an error.

   The list should look like the following if you have a single object that configures your custom group policies:

   
   

   

   
   

5. Click Save.

6. If you have not yet assigned all the targeted devices to the policy, click the Policy Assignments link below Save and make the assignments now.

7. Click Preview Config, and in the Preview dialog box, select one of the assigned devices.

   The system generates a preview of the configuration CLI that will be sent to the device. Verify that the commands generated from the objects look correct. These will be shown at the end of the preview. Note that you will also see commands generated from other changes you have made to managed features. For the dynamic split tunnel commands, you should see something similar to the following:

   
   ###Flex-config Appended CLI ###
   webvpn
    anyconnect-custom-attr dynamic-split-exclude-domains description traffic for these domains will not be sent to the VPN headend
    anyconnect-custom-data dynamic-split-exclude-domains excludeddomains webex.com,ciscospark.com
   group-policy sales attributes
    anyconnect-custom dynamic-split-exclude-domains value excludeddomains
   

Step 5

Deploy your changes.

Step 6

Verify the configuration.

Step 1

Create the deploy-once/append FlexConfig object that removes the custom attribute from each group policy that uses it, then deletes the attribute.

1. Choose Objects > Object Management.

2. Choose FlexConfig > FlexConfig Object from the table of contents.

3. Click Add FlexConfig Object, configure the following properties, and click Save.

   • Name—The object name. For example, Disable_Dynamic_Split_Tunnel.

   • Deployment—Select Once. These commands need to be configured one time.

   • Type—Keep the default, Append. The commands are sent to the device after the commands for directly-supported features.

   • Object body—In the object body, type the commands needed to remove the custom attribute from each group policy that uses it, and then delete the custom attribute. For example, if the custom attribute is used by the sales group policies, and the attribute is named excludeddomains, the commands would be the following:

     
     group-policy sales attributes
      no anyconnect-custom dynamic-split-exclude-domains
     
     no anyconnect-custom-data dynamic-split-exclude-domains excludeddomains
     
     webvpn
      no anyconnect-custom-attr dynamic-split-exclude-domains
     

   The object should look similar to the following:

   
   

   

   
   

Step 2

Edit the FlexConfig policy to remove the dynamic split tunneling objects and add the object that removes the configuration.

1. Choose Devices > FlexConfig.

2. Edit the FlexConfig policy.

3. In the Selected Appended FlexConfigs list, click the delete icon for each of the dynamic split tunnel objects, the ones that enable the custom attribute and then add the attribute to the group policies.

4. Select the FlexConfig object that disables dynamic split tunneling in the User Defined folder in the table of contents and click > to add it to the policy.

   The object should be added to the Selected Appended FlexConfigs list.

   The list should look like the following:

   
   

   

   
   

5. Click Save.

6. Click Preview Config, and in the Preview dialog box, select one of the assigned devices.

   The system generates a preview of the configuration CLI that will be sent to the device. Verify that the commands generated from the objects look correct. These will be shown at the end of the preview. Note that you will also see commands generated from other changes you have made to managed features. For the dynamic split tunnel commands, you should see something similar to the following:

   
   ###Flex-config Appended CLI ###
   group-policy sales attributes
    no anyconnect-custom dynamic-split-exclude-domains
   
   no anyconnect-custom-data dynamic-split-exclude-domains excludeddomains
   
   webvpn
    no anyconnect-custom-attr dynamic-split-exclude-domains
   

Step 3

Deploy your changes.

Step 1

Create the deploy-once/append FlexConfig object that creates the LDAP map, including attribute/value mappings. This object creates the map only, it does not assign the map to an AD/LDAP server.

1. Choose Objects > Object Management.

2. Choose FlexConfig > FlexConfig Object from the table of contents.

3. Click Add FlexConfig Object, configure the following properties, and click Save.

   • Name—The object name. For example, Create_LDAP_Map_for_VPN_Access.

   • Deployment—Select Once. These commands need to be configured one time.

   • Type—Keep the default, Append. The commands are sent to the device after the commands for directly-supported features.

   • Object body—In the object body, type the commands needed to create the LDAP map, map the AD/LDAP attribute to a Cisco attribute, and then map values for that attribute (as returned from AD/LDAP) to values that are meaningful for the Cisco attribute.

     In the following example:

     • LDAP_Map_for_VPN_Access is the name of the LDAP attribute map. This can be any name you want.

     • memberOf is the name of an AD/LDAP attribute, which is defined in the server itself. This is not a random string.

     • Group-Policy is the name of a Cisco attribute, and is also not a random string.

     • CN=APP-SSL-VPN Managers,CN=Users,OU=stbu,DC=example,DC=com is a value you expect AD/LDAP to return in the memberOf attribute during authentication. This string is based on how your AD/LDAP server is configured. This string indicates that the user is a member of the APP-SSL-VPN Managers user group.

     • LabAdminAccessGroupPolicy is the name of a group policy that you have defined in FMC and that you are using in the RA VPN connection profile. This string must match the name of an existing group policy.

     • CN=Engineering,CN=Users,OU=stbu,DC=example,DC=com is a value you expect returned in the memberOf attribute. This string indicates that the user is a member of the Engineering user group.

     • VPNAccessGroupPolicy is the name of a group policy that already exists and is used in the RA VPN.

     The commands for this configuration would be the following:

     
     ldap attribute-map LDAP_Map_for_VPN_Access
      map-name memberOf Group-Policy
      map-value memberOf CN=APP-SSL-VPN Managers,CN=Users,OU=stbu,DC=example,DC=com LabAdminAccessGroupPolicy
      map-value memberOf CN=Engineering,CN=Users,OU=stbu,DC=example,DC=com VPNAccessGroupPolicy 
     

   The object should look similar to the following:

   
   

   

   
   

Step 2

Create the deploy-everytime/append FlexConfig object that assigns the map to an AD/LDAP server.

Because you define the AD/LDAP realm directly in Firepower Management Center, your FlexConfig changes to the realm will be removed during each deployment. Therefore, you must configure them again at the end of each deployment job.

On the FlexConfig Objects page, click Add FlexConfig Object, configure the following properties, and click Save.

• Name—The object name. For example, Attach_LDAP_Map_for_VPN_Access.

• Deployment—Select Everytime.

• Type—Keep the default, Append.

• Object body—In the object body, type the commands needed to assign the map to the AD server used for the RA VPN.

  In the following example:

  • LDAP_Map_for_VPN_Access is the name of the LDAP attribute map you created in the previous FlexConfig object.

  • ad_realm is the name of the AD/LDAP realm you are using in the RA VPN, and 10.100.10.10 is the IP address of a server in the realm. In this example, we assume there is just one server. If there are more, you need to repeat the aaa-server and subsequent ldap-attribute-map commands for each server. Note that the realm name could be anything you choose, but for this command, it must exactly match the name of the realm you created and used in the RA VPN connection you are modifying. The server address likewise must be one that is actually configured within the realm.

  The commands for this configuration would be the following:

  
  aaa-server ad-realm host 10.100.10.10 
   ldap-attribute-map LDAP_Map_for_VPN_Access
   exit
  

The object should look similar to the following:

Step 3

Create the FlexConfig policy that deploys these objects.

1. Choose Devices > FlexConfig.

2. Either click New Policy, or if an existing FlexConfig policy should be assigned to (or is already assigned to) the target devices, simply edit that policy.

   When creating a new policy, assign the target devices to the policy in the dialog box where you name the policy.

3. Use Ctrl+Click to select the FlexConfig objects in the User Defined folder in the table of contents and click > to add them to the policy.

   The objects should be added to the Selected Appended FlexConfigs list.

4. Use drag and drop to ensure that the objects are in the correct order.

   The object that creates the LDAP attribute map must come before the object that assigns the map to an AD/LDAP server. Otherwise, if you try to assign an LDAP attribute map that does not yet exist, you will get an error.

   The list should look like the following:

   
   

   

   
   

5. Click Save.

6. If you have not yet assigned all the targeted devices to the policy, click the Policy Assignments link below Save and make the assignments now.

7. Click Preview Config, and in the Preview dialog box, select one of the assigned devices.

   The system generates a preview of the configuration CLI that will be sent to the device. Verify that the commands generated from the objects look correct. These will be shown at the end of the preview. Note that you will also see commands generated from other changes you have made to managed features. For the LDAP attribute commands, you should see something similar to the following:

   
   ###Flex-config Appended CLI ######Flex-config Appended CLI ###
   ldap attribute-map LDAP_Map_for_VPN_Access
   
    map-name memberOf Group-Policy
   
    map-value memberOf CN=APP-SSL-VPN Managers,CN=Users,OU=stbu,DC=example,DC=com LabAdminAccessGroupPolicy
   
    map-value memberOf CN=Engineering,CN=Users,OU=stbu,DC=example,DC=com VPNAccessGroupPolicy
   
   aaa-server ad-realm host 10.100.10.10 
   
    ldap-attribute-map LDAP_Map_for_VPN_Access
   
    exit
   

Step 4

Deploy your changes.

Step 5

Verify the configuration.

Step 1

Create the deploy-once/append FlexConfig object that deletes the LDAP attribute map.

1. Choose Objects > Object Management.

2. Choose FlexConfig > FlexConfig Object from the table of contents.

3. Click Add FlexConfig Object, configure the following properties, and click Save.

   • Name—The object name. For example, Delete_LDAP_Map_for_VPN_Access.

   • Deployment—Select Once. These commands need to be configured one time.

   • Type—Keep the default, Append. The commands are sent to the device after the commands for directly-supported features. This is particularly important because you are depending on the deployment job to remove commands that use the LDAP attribute map.

   • Object body—In the object body, type the command needed to delete the LDAP attribute map. Note that you do not need to remove the contents of the map. You simply delete the map and its contents are also removed. For example, if the map is named LDAP_Map_for_VPN_Access, the command would be the following:

     
     no ldap attribute-map LDAP_Map_for_VPN_Access
     

   The object should look similar to the following:

   
   

   

   
   

Step 2

Edit the FlexConfig policy to remove the objects that create and assign the LDAP attribute map, and add the object that deletes the map.

1. Choose Devices > FlexConfig.

2. Edit the FlexConfig policy.

3. In the Selected Appended FlexConfigs list, click the delete icon for the objects that create and assign the LDAP attribute map.

4. Select the FlexConfig object that deletes the map in the User Defined folder in the table of contents and click > to add it to the policy.

   The object should be added to the Selected Appended FlexConfigs list.

   The list should look like the following:

   
   

   

   
   

5. Click Save.

6. Click Preview Config, and in the Preview dialog box, select one of the assigned devices.

   The system generates a preview of the configuration CLI that will be sent to the device. Verify that the commands generated from the objects look correct. These will be shown at the end of the preview. Note that you will also see commands generated from other changes you have made to managed features. For this example, you should see something similar to the following:

   
   ###Flex-config Appended CLI ###
   no ldap attribute-map LDAP_Map_for_VPN_Access
   

Step 3

Deploy your changes.

Step 1

Download the Cisco AnyConnect Enterprise Application Selector from software.cisco.com. You can find this application under the AnyConnect Secure Mobility Client v4.x category.

Step 2

Define the Per App VPN policy using the AnyConnect Enterprise Application Selector.

1. In the AnyConnect Enterprise Application Selector, select Android as the platform type, then fill in the following options:

   • Friendly Name—Something meaningful, such as Allow_All.

   • App ID—Enter *.* to match all possible applications.

   • Ignore all other fields. These are used to fine to a policy to exact applications and versions.

   
   

   

   
   

2. Select iOS as the platform type, then fill in the following options:

   • Friendly Name—Something meaningful, such as Allow_All.

   • App ID—Enter *.* to match all possible applications.

   • Ignore all other fields.

   
   

   

   
   

3. Select Policy > View Policy.

   You will get an unreadable base64 string. This string actually contains an encrypted XML file that the FTD system will unpack to see the policies you created. You will use a copy of this string in subsequent steps.

   
   

   

   
   

Step 3

Create the deploy-once/append FlexConfig object that creates the perapp custom attribute and assigns to the attribute the per-app base64 policy created in the AnyConnect Enterprise Application Selector.

1. Choose Objects > Object Management.

2. Choose FlexConfig > FlexConfig Object from the table of contents.

3. Click Add FlexConfig Object, configure the following properties, and click Save.

   • Name—The object name. For example, Per_App_Allow_All_Policy.

   • Deployment—Select Once. These commands need to be configured one time.

   • Type—Keep the default, Append. The commands are sent to the device after the commands for directly-supported features.

   • Object body—In the object body, type the commands needed to create an attribute of the type perapp, then add the data, which is an attribute name and the base64 policy string. Note that the data element is limited to 420 characters, so if the base64 string is longer than that, you must divide it and use multiple anyconnect-custom-data commands. When you use multiple data commands for a given variable, the second and subsequent commands are simply appended to the initial data string. You can either precisely cut the base64 string at 420 characters, or just cut it into easy to handle chunks. For example, to create an attribute named perAppPolicy, and to use your Allow_All policy, the commands would be the following. Note that the description is optional, but if included, it is not a separate command but part of the anyconnect-custom-attr command. (Note that in this example line returns are added to enhance readability.)

     
     webvpn 
      anyconnect-custom-attr perapp description Per-App Allow All VPN Policy 
      anyconnect-custom-data perapp perAppPolicy 
     eJyVkFtvgkAQhf8K2adWqBcUNb4hGhG8oKBFG9NsZYVVYJHlquG/d20aH/rWl5kzZ06+
     ZOYOFEyPRCFRGWPXS8AAPDX3cnzlxGazw/1kOLOkCQqowE3DYx0IYI4S6MAEgsEd6CEp
     Hn08mjNE7uvxbOnIw0VpxMb7TYTuWsWdnTQpA090gqxzUrwLSfEKuX2xsUlGUNzbs62X
     GvnNvO4z1PN5gmzN7GYmn3Ya41Ueild3hNt0i6/8Rj
      anyconnect-custom-data perapp perAppPolicy 
     pPWyd+j/NM1W2rkLrbiyEXFJ6thJ+s+b4Y3NRbsQvgxO0a1pdEbA2pQXuupyHclcVSMxW
     qFHxDlsRN09CksUZ3JOttnayFhucFqCoBjFCGj2iGKXvKx/13tMoIsQNh6MQEO+wJchQ9
     IzCKmDcAtXqNbU4hDB5Z2fdJ/skq8+BD00coiVNUHSrhLziKfPSGCf0nmqEO1TcMGZio
     

   The object should look similar to the following:

   
   

   

   
   

Step 4

If you use custom group policies, create a deploy-once/append FlexConfig object to configure the dynamic split tunnel custom attribute in the group policies.

1. Choose Objects > Object Management.

2. Choose FlexConfig > FlexConfig Object from the table of contents.

3. Click Add FlexConfig Object, configure the following properties, and click Save.

   • Name—The object name. For example, Add_Per_App_VPN.

   • Deployment—Select Once.

   • Type—Keep the default, Append.

   • Object body—In the object body, type the commands needed to add the custom attribute to the group policy. For example, if the attribute you created is named perAppPolicy, and the group policy is named “sales,” the commands are:

     
     group-policy sales attributes 
      anyconnect-custom perapp value perAppPolicy 
     

   The object should look similar to the following:

   
   

   

   
   

Step 5

Create the FlexConfig policy that deploys these objects.

1. Choose Devices > FlexConfig.

2. Either click New Policy, or if an existing FlexConfig policy should be assigned to (or is already assigned to) the target devices, simply edit that policy.

   When creating a new policy, assign the target devices to the policy in the dialog box where you name the policy.

3. Use Ctrl+Click to select the FlexConfig objects in the User Defined folder in the table of contents and click > to add them to the policy.

   The objects should be added to the Selected Appended FlexConfigs list.

4. Use drag and drop to ensure that the objects are in the correct order.

   The object that creates the custom attribute object must come before the objects that assign that attribute to the group policies. Otherwise, if you try to add a custom attribute that does not yet exist, you will get an error.

   The list should look like the following if you have a single object that configures your custom group policies:

   
   

   

   
   

5. Click Save.

6. If you have not yet assigned all the targeted devices to the policy, click the Policy Assignments link below Save and make the assignments now.

7. Click Preview Config, and in the Preview dialog box, select one of the assigned devices.

   The system generates a preview of the configuration CLI that will be sent to the device. Verify that the commands generated from the objects look correct. These will be shown at the end of the preview. Note that you will also see commands generated from other changes you have made to managed features. For these commands, you should see something similar to the following:

   
   

   

   
   

Step 6

Deploy your changes.

Step 7

Verify the configuration.