A network administrator deployed IKEv2 Cisco AnyConnect on a Cisco ASA. The current configuration tunnels all traffic through the VPN. Users report poor performance with cloud-based applications…

Configuring QoS on the ASA outside interface prioritizes traffic within the existing path but does not reduce the fundamental RTT penalty caused by routing Webex traffic through the corporate data center.

Switching AnyConnect from TLS to DTLS reduces per-packet overhead and head-of-line blocking but does not change the traffic path, so the cloud backhauling latency problem remains.

A dynamic split tunnel exclusion configures Cisco AnyConnect to exclude specific destination traffic such as Webex IP ranges from being tunneled, allowing that traffic to egress directly to the internet. This eliminates the additional RTT introduced by routing cloud traffic through the corporate ASA and directly addresses the high latency and missing duplicate ACKs observed in packet analysis.

Reducing the tunnel MTU influences fragmentation behavior, but the packet analysis explicitly shows no IP fragments, confirming that MTU is not contributing to the performance degradation.