Configure Secure Client management VPN tunnel on Firewall Threat Defense

The management VPN tunnel allows endpoints to automatically establish VPN connectivity at startup, ensuring immediate access to corporate resources. This configuration requires setting up a dedicated connection profile and management VPN profile specifically for the management tunnel.

Procedure

Step 1

Create a remote access VPN policy.

Choose Secure Connections > Remote Access VPN

For information, refer to Configure a remote access VPN policy.

Step 2

Configure the management VPN tunnel connection profile settings:

Note

Create a dedicated connection profile for the Secure Client management VPN tunnel.

  1. Click the edit icon next to the remote access VPN policy

  2. Click the edit icon next to the connection profile that you want to modify.

  3. Click the AAA tab.

  4. From the Authentication Method drop-down list, choose Client Certificate Only

  5. Configure the authorization and accounting settings.

  6. Click the Aliases tab of the connection profile.

  7. In URL Alias, click +.

  8. In the Add URL Alias dialog box, configure these parameters:

    1. From the URL Alias drop-down list, choose a URL alias.

    2. Check the Enabled check box to enable the URL.

    3. Click OK.

  9. Click Save to save the connection profile settings.

Step 3

Create a management VPN profile using the Secure Client profile editor:

  1. Download the Secure Client Profile Editor from Cisco Software Download Center.

  2. Create a Secure Client management VPN profile with the required settings for your VPN users and save the file.

    The management VPN profile stores all settings required to establish the VPN tunnel at endpoint startup.

  3. In the management VPN profile server list, specify the server as the group URL from the connection profile (Step 2h).

Step 4

Create a VPN profile using the Secure Client profile editor.

Step 5

Upload the Secure Client management VPN profile and VPN profile to Cloud-Delivered Firewall Management Center:

  1. Choose Objects > VPN > Secure Client File

  2. Click Add Secure Client File.

  3. In the Add Secure Client File dialog box, configure these parameters:

    1. In the Name field, enter the name of the Secure Client management VPN profile file.

    2. From the File Type drop-down, choose Secure Client Management VPN Profile.

    3. Click Browse and select the management VPN profile file.

    4. Click Save.

  4. Repeat Step 5b to Step 5c to upload the Secure Client VPN profile to Cloud-Delivered Firewall Management Center.

Step 6

Associate the management VPN profile with a group policy and configure group policy settings:

Add the management VPN profile to the group policy associated with the management tunnel connection profile. When a user connects, Secure Client downloads both the management VPN profile and the user VPN profile. This action enables the management VPN tunnel.

  1. Click the edit icon next to the connection profile that you want to modify.

  2. Click Edit Group Policy. Edit Group Policy > Secure Client > Management Profile Edit Group Policy and choose AnyConnect Secure Client, then click Management Profile.

  3. In the Edit Group Policy dialog box, click the Secure Client tab.

  4. From the left pane, choose Management Profile.

  5. From the Management VPN Profile drop-down list, choose the management profile file.

  6. Click Save.

Note

Ensure that the group policy does not have a banner. To check the banner settings, edit the connection profile. Click the General tab and select Banner.

Step 7

Configure split tunneling in the group policy.

For information, refer to Configure split tunneling.

Step 8

Deploy the configuration on the Firewall Threat Defense device.

What to do next

Verify Secure Client management VPN tunnel.