An organization is deploying a Cisco AnyConnect Remote Access VPN solution for remote employees. The security policy mandates that all corporate traffic destined for internal enterprise subnets must be encrypted and forwarded through the VPN tunnel, while standard internet traffic should bypass the tunnel and route directly out the user's local network interface to preserve corporate WAN bandwidth. Additionally, remote clients must dynamically acquire private IP addresses and internal DNS server settings upon successful authentication. Which combination of VPN features and tunneling configurations meets these requirements?
- AConfigure a site-to-site IPsec tunnel using GRE encapsulation with full-tunneling enabled on the headend router.
- Configure an SSL/TLS or IPsec Remote Access VPN using split-tunneling with an access list specifying internal corporate destination networks.Answer
- CConfigure an IPsec Remote Access VPN using Authentication Header (AH) in transport mode with split-tunneling disabled.
- DConfigure a site-to-site IPsec tunnel utilizing Encapsulating Security Payload (ESP) in transport mode with dynamic NAT overload applied on the client end.
Answer
The correct architecture requires a Remote Access VPN deployment utilizing split-tunneling controlled by an access list that defines internal corporate network destinations.
Remote Access VPNs are designed for individual client endpoints connecting to a central site, pushing configurations dynamically. Enabling split-tunneling with a targeted destination ACL ensures that only traffic destined for internal corporate networks is encrypted and routed through the tunnel, while local internet access remains unencumbered.
Step-by-Step Solution
Key Concept
Remote Access VPN Architecture and Split-Tunneling Operation