! PermitANY — Cisco ASA AnyConnect SSL VPN
! Configure Cisco AnyConnect SSL VPN on an ASA for remote user access — the most common remote access VPN solution in enterprise environments.
! Generated: 2026-09-21
! These are EXAMPLE values. Replace with your actual config before deploying.
!
! ── IP Pool for VPN clients ──────────────────────────
ip local pool ANYCONNECT-POOL 10.100.0.1-10.100.0.254 mask 255.255.255.0
!

! ── Group Policy ─────────────────────────────────────
group-policy GP-ANYCONNECT internal
group-policy GP-ANYCONNECT attributes
 vpn-tunnel-protocol ssl-client
 split-tunnel-policy tunnelall

 dns-server value 8.8.8.8 8.8.4.4
 vpn-idle-timeout 30
 vpn-simultaneous-logins 100
!
! ── Tunnel Group ─────────────────────────────────────
tunnel-group ANYCONNECT-USERS type remote-access
tunnel-group ANYCONNECT-USERS general-attributes
 address-pool ANYCONNECT-POOL
 default-group-policy GP-ANYCONNECT
tunnel-group ANYCONNECT-USERS webvpn-attributes
 group-alias ANYCONNECT-USERS enable
!
! ── WebVPN (AnyConnect) ──────────────────────────────
webvpn
 enable outside
 anyconnect enable
 tunnel-group-list enable
!
! ── NAT exemption for VPN clients ────────────────────
object network VPN_POOL
 subnet 10.100.0.1 255.255.255.0
nat (inside,outside) 1 source static any any destination static VPN_POOL VPN_POOL no-proxy-arp
!
! ── Local user (for testing — use LDAP/RADIUS in prod)

username vpnuser1 password VpnUs3r!Pass privilege 0
username vpnuser1 attributes
 vpn-group-policy GP-ANYCONNECT
 service-type remote-access

!