I85PREP
⌘ K
Cisco 300-730 SVPN study materials
Cisco 300-730 SVPN study resources

Cisco 300-730 SVPN: Remote access VPNs

Cisco 300-730 SVPN · Work through your exam, one topic at a time.

All guide sections

Remote access VPNs

Remote access VPNs

This domain covers client-based and clientless access: IKEv2 remote access, AnyConnect SSL VPN, Clientless SSL VPN, Start Before Logon, split tunneling, and authorization. Questions often ask which component supplies an address, which policy controls what the client can reach, and where authentication stops.

Core rules

  • IKEv2 remote access uses an IKEv2 profile, an AAA method such as EAP, a local IP pool, and a virtual-template interface. The client gets an inner address from the pool; the IKEv2 profile binds authentication, authorization, and the IPsec profile.
  • AnyConnect SSL uses TLS on TCP 443 and optionally DTLS on UDP 443. DTLS improves latency for real-time traffic; if UDP 443 is blocked, AnyConnect falls back to TLS and still works.
  • Clientless SSL provides portal bookmarks, web browsing, and limited plug-ins. It does not run a full tunnel and cannot support arbitrary thick-client protocols.
  • Split tunneling is controlled by a group policy and an ACL. With tunnelspecified, only destinations permitted by the split-tunnel ACL are sent through the VPN; everything else uses the local Internet path. DNS behavior is separate: split-DNS decides which names go to internal DNS.
  • SBL starts AnyConnect before Windows logon so domain credentials and computer certificate authentication can occur; it requires a suitable client profile and typically a machine certificate.

Worked example

An AnyConnect user authenticates and receives 10.10.10.50, but cannot open an internal server at 192.168.50.20; public Internet works. show vpn-sessiondb detail anyconnect shows the session is up and the tunneled network list contains only 10.10.10.0/24. Reasoning: the group policy uses split tunneling, so 192.168.50.0/24 is not routed into the tunnel. Add that network to the split-tunnel ACL and refresh the session. If the user also cannot resolve server.corp.example, check split-DNS rather than the tunnel ACL.

Traps

Certificate identity is a common failure: the client compares the portal certificate name with the URL, so a missing SAN causes a warning or failure. DTLS being blocked is not a total outage, only a performance change. Clientless is not a substitute for AnyConnect when custom ports or non-web applications are required. SBL is a Windows logon feature, not a replacement for user authentication. Finally, split-tunnel ACL direction and ordering matter; an implicit deny can exclude the very subnet you meant to include.