An engineer must modify an existing remote access VPN using a Cisco AnyConnect Secure Mobility client solution and a Cisco Secure Firewall. Currently, all the traffic generated by the user is sent…

NAT exemption prevents NAT from occurring for traffic within the VPN, but it does not control whether traffic is initially directed into or out of the VPN tunnel.

The encryption domain defines which traffic is encrypted by the VPN, but for AnyConnect, the more granular control over what client-initiated traffic enters the tunnel is managed through split tunneling within the group policy.

While the client's routing table is updated by the VPN connection, the administrative control to modify these client-side routing directives for specific traffic exclusions resides within the firewall's group policy configuration.

In a Cisco AnyConnect VPN deployment, split tunneling behavior, which dictates what traffic goes through the VPN tunnel versus what traffic accesses the local network directly, is configured within the group policy on the Cisco Secure Firewall. Modifying the group policy's split tunneling network list will achieve the goal of excluding specific servers.