nerdexam
Cisco

300-730 · Question #79

A network engineer must implement an SSLVPN Cisco AnyConnect solution that supports 500 concurrent users, ensures all traffic from the client passes through the ASA, and allows users to access all…

The correct answer is A. group-policy DfltGrpPolicy internal group-policy DfltGrpPolicy attributes split-tunnel-policy tunnelall address-pools value ACPool ip local pool ACPool 10.0.0.1-10.0.0.254 mask 255.255.252.0. Full-tunnel AnyConnect for 500 users requires 'tunnelall' to route all traffic through the ASA and an address pool large enough to support 500 concurrent leases.

Remote Access VPN

Question

A network engineer must implement an SSLVPN Cisco AnyConnect solution that supports 500 concurrent users, ensures all traffic from the client passes through the ASA, and allows users to access all devices on the inside interface subnet (192.168.0.0/24). Assuming all other configuration is set up appropriately, which configuration implements this solution?

Options

  • Agroup-policy DfltGrpPolicy internal group-policy DfltGrpPolicy attributes split-tunnel-policy tunnelall address-pools value ACPool ip local pool ACPool 10.0.0.1-10.0.0.254 mask 255.255.252.0
  • Baccess-list ACsplit standard permit 192.168.0.0 255.255.255.0 group-policy DfltGrpPolicy internal group-policy DfltGrpPolicy attributes split-tunnel-policy tunnelspecified split-tunnel-network-list value ACsplit address-pools value ACPool ip local pool ACPool 10.0.0.1-10.0.0.254 mask 255.255.252.0
  • Caccess-list ACsplit standard permit 192.168.0.0 255.255.255.0 group-policy DfltGrpPolicy internal group-policy DfltGrpPolicy attributes split-tunnel-policy tunnelspecified split-tunnel-network-list value ACsplit address-pools value ACPool
  • Dgroup-policy DfltGrpPolicy internal group-policy DfltGrpPolicy attributes split-tunnel-policy tunnelall address-pools value ACPool ip local pool ACPool 10.0.0.1-10.0.0.254 mask 255.255.255.0

How the community answered

(16 responses)
  • A
    56% (9)
  • B
    25% (4)
  • C
    13% (2)
  • D
    6% (1)

Why each option

Full-tunnel AnyConnect for 500 users requires 'tunnelall' to route all traffic through the ASA and an address pool large enough to support 500 concurrent leases.

Agroup-policy DfltGrpPolicy internal group-policy DfltGrpPolicy attributes split-tunnel-policy tunnelall address-pools value ACPool ip local pool ACPool 10.0.0.1-10.0.0.254 mask 255.255.252.0Correct

The 'split-tunnel-policy tunnelall' directive ensures all client traffic is forced through the ASA, satisfying the full-tunnel requirement. The pool 10.0.0.1-10.0.0.254 with mask 255.255.252.0 is a /22 network providing 1022 usable addresses, which comfortably supports 500 concurrent users. Answer D uses the same tunnelall policy but has a /24 mask (255.255.255.0) yielding only 254 addresses, which is insufficient for 500 users.

Baccess-list ACsplit standard permit 192.168.0.0 255.255.255.0 group-policy DfltGrpPolicy internal group-policy DfltGrpPolicy attributes split-tunnel-policy tunnelspecified split-tunnel-network-list value ACsplit address-pools value ACPool ip local pool ACPool 10.0.0.1-10.0.0.254 mask 255.255.252.0

'split-tunnel-policy tunnelspecified' sends only the listed ACL traffic through the tunnel, meaning general Internet traffic bypasses the ASA and violates the 'all traffic through ASA' requirement.

Caccess-list ACsplit standard permit 192.168.0.0 255.255.255.0 group-policy DfltGrpPolicy internal group-policy DfltGrpPolicy attributes split-tunnel-policy tunnelspecified split-tunnel-network-list value ACsplit address-pools value ACPool

Same split-tunnel problem as B, and additionally the 'ip local pool' definition is missing, so the ASA has no pool to assign addresses from.

Dgroup-policy DfltGrpPolicy internal group-policy DfltGrpPolicy attributes split-tunnel-policy tunnelall address-pools value ACPool ip local pool ACPool 10.0.0.1-10.0.0.254 mask 255.255.255.0

While 'tunnelall' is correct, the pool mask 255.255.255.0 creates only a /24 pool with 254 addresses, which cannot support 500 concurrent users.

Concept tested: AnyConnect full-tunnel policy and address pool sizing

Source: https://www.cisco.com/c/en/us/td/docs/security/asa/asa96/configuration/vpn/asa-96-vpn-config/vpn-remote-access.html

Topics

#AnyConnect#tunnel-all#address pool#group policy configuration

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 300-730 Practice