Web Security​ - Configuring Cisco AnyConnect

This article describes how to configure Cisco AnyConnect and is intended for use by Administrators.

Considerations 

Whilst Cisco AnyConnect is compatible with the Mimecast Security Agent, you may experience connectivity issues when in split tunnel mode, depending on your configuration. 
You can configure Cisco AnyConnect VPN and Mimecast Security Agent to integrate on the same machine by updating your secure routes.
This is required to ensure Cisco AnyConnect doesn't drop Mimecast packets, as you would be unable to access local resources.

Prerequisites

• • • You are configuring Cisco AnyConnect for use with Mimecast Security Agent for Windows only. 

Cisco AnyConnect is not compatible with Mimecast Security Agent for Mac, you would need to disable Cisco AnyConnect in order to allow Mimecast Security Agent for Mac to work.

Configuring Secure Routes

Secure routes specify where the destination network traffic is sent via your active VPN Client connection.
For the Mimecast Security Agent to be compatible with Cisco AnyConnect, you must add the IP range from the IP Address Assignment policy to your secured routes. These are the internal IPs that the Cisco AnyConnect clients are issued by the DHCP or Internal Address Pool.

Refer to Cisco's AnyConnect documentation when updating your secure routes.

You can manage your Secure Routes by using the following steps:

1. Connect to VPN to verify the IP range used.
2. Enter ipconfig at a command prompt.
    
3. In this example the connected client is issued 172.16.20.4 because the IP Address Assignment policy is configured to use the 172.16.20.0/24 IP range.
4. Add the IP Address Range to the Secured Routes to ensure compatibility.
5. Verify that the IP range was added successfully by clicking on the Route Details tab on the Cisco AnyConnect client.