Configure AnyConnect Remote Access VPN on a Cisco ASA

Before you run this

This guide configures a Cisco AnyConnect (Secure Client) SSL remote-access VPN on an ASA so remote users can dial in, receive an internal IP from a pool, and reach inside subnets over an encrypted tunnel. It creates address pools, a group policy, a connection profile (tunnel-group), a split-tunnel ACL, a NAT exemption, and at least one VPN user.

Privileges: every command here is entered from ASA privileged EXEC + global configuration mode — you need enable access and configure terminal. There is no OS shell involved; this is the ASA's own CLI.

This is a production firewall. Treat it accordingly:

• Keep a console (out-of-band) session open the whole time. A wrong nat line, a fat-fingered access-group, or enable outside colliding with existing HTTPS management can cut you off from the box and interrupt production traffic. The console port cannot be shut out by a bad rule; SSH can.
• Back up the running config before you touch anything. From enable mode: show running-config and copy it off, or copy running-config tftp: to a server. The ASA has no timed commit / auto-rollback — changes apply the instant you press Enter. Your rollback is the saved config.
• Do this in a maintenance window. Enabling WebVPN on the outside interface changes how that interface answers on TCP 443.
• Do not write memory until you have verified a successful client connection. While the change is unsaved, a reload restores the last saved config — that is your escape hatch if you lock yourself out (which is why the console session matters).
• Read the whole procedure first and, if you can, try it on a lab ASA or ASAv VM before the real one.

Licensing note: AnyConnect / Cisco Secure Client requires a client VPN licence (historically AnyConnect Plus/Apex, now Secure Client). Confirm yours with show version before you promise anyone remote access.

What I'm assuming

• ASA software 9.16(x), hardware ASA 5500-X or ASAv. Syntax is stable across the 9.x train, but menus and package names move, so check show version.
• The outside interface is named outside and the inside interface inside. Substitute your actual names.
• Authentication is against the ASA local user database. RADIUS/ISE is the other common path; I mention it but don't walk through it.
• The AnyConnect/Secure Client .pkg image is already uploaded to disk0:. If not, copy it up with copy tftp: disk0: first.

Replace every placeholder below — 192.168.1.0/24 (inside network), 10.10.10.0/24 (VPN pool), vpn.example.com, example.com, and the username — with your own values.

Step 1 — Upload and register the client image

If the image isn't on the box yet, copy it, then register it under WebVPN. Filenames differ between AnyConnect 4.x (anyconnect-win-...-webdeploy-k9.pkg) and Secure Client 5.x (cisco-secure-client-win-...-webdeploy-k9.pkg) — use the exact name shown by dir disk0:.

webvpn
 enable outside
 anyconnect image disk0:/cisco-secure-client-win-5.1.x.x-webdeploy-k9.pkg 1
 anyconnect enable
 tunnel-group-list enable

enable outside turns on the SSL VPN listener on the outside interface. tunnel-group-list enable shows the connection-profile drop-down on the login page.

Step 2 — Create the client address pool

ip local pool VPN-POOL 10.10.10.10-10.10.10.100 mask 255.255.255.0

Pick a subnet that does not overlap any inside network or any other VPN pool.

Step 3 — Split-tunnel ACL and group policy

The standard ACL lists the internal networks that should go through the tunnel; everything else goes out the client's local link.

access-list SPLIT-ACL standard permit 192.168.1.0 255.255.255.0

group-policy GP-ANYCONNECT internal
group-policy GP-ANYCONNECT attributes
 vpn-tunnel-protocol ssl-client
 dns-server value 192.168.1.10
 default-domain value example.com
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value SPLIT-ACL

If you want all client traffic to traverse the ASA instead, set split-tunnel-policy tunnelall and drop the network-list line — but then you also need internet return-path NAT for VPN clients, which is beyond this guide.

Step 4 — Connection profile (tunnel-group) and a user

tunnel-group TG-ANYCONNECT type remote-access
tunnel-group TG-ANYCONNECT general-attributes
 address-pool VPN-POOL
 default-group-policy GP-ANYCONNECT
tunnel-group TG-ANYCONNECT webvpn-attributes
 group-alias AnyConnect enable

Create a test user. privilege 0 keeps a VPN user out of enable mode:

username testvpn password ChangeMe_StrongP@ss privilege 0

For directory-backed auth, you'd define an aaa-server group (RADIUS/LDAP) and reference it under the tunnel-group's general-attributes with authentication-server-group. Check the Cisco ASA VPN CLI configuration guide for the exact aaa-server syntax for your directory — don't guess it.

Step 5 — Exempt VPN traffic from NAT

Without this, traffic from inside hosts back to VPN clients gets translated and the return path breaks. This is manual (twice) NAT with objects:

object network NET-INSIDE
 subnet 192.168.1.0 255.255.255.0
object network NET-VPN-POOL
 subnet 10.10.10.0 255.255.255.0

nat (inside,outside) source static NET-INSIDE NET-INSIDE destination static NET-VPN-POOL NET-VPN-POOL no-proxy-arp route-lookup

This NAT rule must sit above any general outbound PAT rule in the NAT table, or the PAT wins. Confirm ordering with show nat.

Step 6 — The SSL certificate

By default the ASA presents a self-signed certificate and clients get a trust warning. For a small/lab deployment a self-signed cert is workable:

crypto ca trustpoint SELF-VPN
 enrollment self
 subject-name CN=vpn.example.com
crypto ca enroll SELF-VPN noconfirm

ssl trust-point SELF-VPN outside

For production, install a certificate from a public or internal CA so clients don't see warnings. The enrollment/import steps (crypto ca PKCS12 import or SCEP/manual enrollment) are easy to get wrong — follow the certificate management chapter of the Cisco ASA configuration guide for the exact commands for your CA.

Step 7 — Interface ACL and VPN traffic

On most ASAs, sysopt connection permit-vpn is enabled by default, which lets decrypted VPN traffic bypass the outside interface ACL. Confirm with show running-config all sysopt. If it's off and you rely on an outside ACL, either turn it back on or add explicit permits — don't assume.

Verify it worked

First, test a real connection: point the Secure Client at https://vpn.example.com, log in as testvpn, pick the AnyConnect profile, and confirm you get a pool address and can reach an inside host.

On the ASA, from enable mode:

show vpn-sessiondb anyconnect

You should see the user, the assigned IP from VPN-POOL, and bytes transferred. Also useful:

show webvpn anyconnect          ! confirms the image is registered and active
show running-config nat         ! confirm the exemption ordering
show ip local pool VPN-POOL     ! confirm addresses are being handed out

Only once a client connects cleanly, save:

copy running-config startup-config

Undo / rollback

Because the ASA applies changes live and has no timed commit, rollback is manual.

• Fastest, if you haven't saved: reload (from console) discards the running config and boots the last-saved startup config.
• If you already saved but need to back out, restore the backup you took in the safety note (copy tftp: running-config, then write memory), or remove each piece with its no form:

no webvpn
no tunnel-group TG-ANYCONNECT
no group-policy GP-ANYCONNECT
clear configure nat
no ip local pool VPN-POOL
no username testvpn

clear configure nat wipes all NAT rules — only use it on a box where you know the full NAT config, otherwise remove the single nat line by re-entering it prefixed with no. When in doubt, restore the backup rather than surgically deleting.

To confirm the VPN is gone: show vpn-sessiondb anyconnect should return no sessions and the outside interface should stop answering on 443.