Dynamic Split Tunneling for O365/Teams/Zoom on ASA

9 July 2020 7 min read

Careful

Be sure that you are basing your ACL on the most current network lists posted by Microsoft/Zoom. These networks do change, and there are automations not mentioned here that can be used to dynamically update your ACL.

CustomerA requires their AnyConnect full tunnel be converted to a dynamic split tunnel to improve cloud conferencing performance and to reduce network congestion.

Initial config:

group-policy grpISE internal
group-policy grpISE attributes
wins-server value 192.200.22.11 192.200.67.32
dns-server value 192.200.22.11 192.200.67.32
vpn-simultaneous-logins 1
vpn-idle-timeout 30
vpn-session-timeout 720
vpn-tunnel-protocol ssl-client ssl-clientless
split-tunnel-policy excludespecified
split-tunnel-network-list value SplitTunnelACL
default-domain value customera.com
client-bypass-protocol enable
msie-proxy server value 192.200.72.91:80
msie-proxy method no-modify
msie-proxy except-list value 127...*;localhost
msie-proxy local-bypass enable
msie-proxy lockdown disable
webvpn
anyconnect mtu 1300
anyconnect ssl keepalive 90
anyconnect dpd-interval client 90
anyconnect dpd-interval gateway 90
anyconnect modules value iseposture
anyconnect profiles value acVPN type user
anyconnect ssl df-bit-ignore enable

Okay, so it’s a split exclude, excluding only 0.0.0.0/32 via SplitTunnelACL Excluding this address will result in your LAN subnet being excluded from the tunnel.

There is a web proxy at 192.200.72.91:80, we will need to bypass proxy for the cloud domains at the WSA. For the sake of this lab let’s assume that’s already been done and the domains placed in the local proxy exclusion list.

tunnel-group tgVPN type remote-access
 tunnel-group tgVPN general-attributes
 address-pool acPool
 authentication-server-group ISE
 accounting-server-group ISE
 default-group-policy grpISE
 username-from-certificate use-entire-name
 tunnel-group tgVPN webvpn-attributes
 group-alias Chicago enable

Before going into production we will create a separate group-policy and tunnel-group we can test from. Adding the tunnel group and an alias will enable a second option in the drop-down during authentication as shown below.

anyconnect image 1

Nothing is really changing other than their access to cloud applications, so we can use the production config as a template and just change the ACL.

group-policy grpDST_TEST internal
group-policy grpDST_TEST attributes
wins-server value 192.200.22.11 192.200.67.32
dns-server value 192.200.22.11 192.200.67.32
vpn-simultaneous-logins 1
vpn-idle-timeout 30
vpn-session-timeout 720
vpn-tunnel-protocol ssl-client ssl-clientless
split-tunnel-policy excludespecified
split-tunnel-network-list value SplitTunnelCloudACL
default-domain value customera.com
client-bypass-protocol enable
msie-proxy server value 192.200.72.91:80
msie-proxy method no-modify
msie-proxy except-list value 127...*;localhost
msie-proxy local-bypass enable
msie-proxy lockdown disable
webvpn
anyconnect mtu 1300
anyconnect ssl keepalive 90
anyconnect dpd-interval client 90
anyconnect dpd-interval gateway 90
anyconnect modules value iseposture
anyconnect profiles value acVPN type user
anyconnect ssl df-bit-ignore enable
tunnel-group tgDST_TEST type remote-access
 tunnel-group tgDST_TEST general-attributes
 address-pool acPool
 authentication-server-group ISE
 accounting-server-group ISE
 default-group-policy grpDST_TEST
 username-from-certificate use-entire-name
 tunnel-group tgVPN webvpn-attributes
 group-alias z_testing_dont_use enable

The dynamic split tunneling takes care of any request using FQDN. To ensure IP to IP connectivity we need to add the splitexclude ACL. Each cloud provider has a list of their ports and ranges.

access-list SplitTunnelCloudACL extended permit ip 104.146.128.0 255.255.128.0 any4
access-list SplitTunnelCloudACL extended permit ip 13.107.128.0 255.255.252.0 any4
access-list SplitTunnelCloudACL extended permit ip 13.107.136.0 255.255.252.0 any4
access-list SplitTunnelCloudACL extended permit ip 13.107.18.10 255.255.255.254 any4
access-list SplitTunnelCloudACL extended permit ip 13.107.6.152 255.255.255.254 any4
access-list SplitTunnelCloudACL extended permit ip 13.107.64.0 255.255.192.0 any4
access-list SplitTunnelCloudACL extended permit ip host 131.253.33.215 any4
access-list SplitTunnelCloudACL extended permit ip 132.245.0.0 255.255.0.0 any4
access-list SplitTunnelCloudACL extended permit ip 150.171.32.0 255.255.252.0 any4
access-list SplitTunnelCloudACL extended permit ip 150.171.40.0 255.255.252.0 any4
access-list SplitTunnelCloudACL extended permit ip 191.234.140.0 255.255.252.0 any4
access-list SplitTunnelCloudACL extended permit ip host 204.79.197.215 any4
access-list SplitTunnelCloudACL extended permit ip 23.103.160.0 255.255.240.0 any4
access-list SplitTunnelCloudACL extended permit ip 40.104.0.0 255.254.0.0 any4
access-list SplitTunnelCloudACL extended permit ip 40.108.128.0 255.255.128.0 any4
access-list SplitTunnelCloudACL extended permit ip 40.96.0.0 255.248.0.0 any4
access-list SplitTunnelCloudACL extended permit ip 52.104.0.0 255.252.0.0 any4
access-list SplitTunnelCloudACL extended permit ip 52.112.0.0 255.252.0.0 any4
access-list SplitTunnelCloudACL extended permit ip 52.96.0.0 255.252.0.0 any4
access-list SplitTunnelCloudACL extended permit ip 3.7.35.0 255.255.255.128 any4
access-list SplitTunnelCloudACL extended permit ip 3.21.137.128 255.255.255.128 any4
access-list SplitTunnelCloudACL extended permit ip 3.22.11.0 255.255.255.0 any4
access-list SplitTunnelCloudACL extended permit ip 3.25.41.128 255.255.255.128 any4
access-list SplitTunnelCloudACL extended permit ip 3.25.42.0 255.255.255.128 any4
access-list SplitTunnelCloudACL extended permit ip 3.80.20.128 255.255.255.128 any4
access-list SplitTunnelCloudACL extended permit ip 3.101.32.128 255.255.255.128 any4
access-list SplitTunnelCloudACL extended permit ip 3.101.52.0 255.255.255.128 any4
access-list SplitTunnelCloudACL extended permit ip 3.104.34.128 255.255.255.128 any4
access-list SplitTunnelCloudACL extended permit ip 3.120.121.0 255.255.255.128 any4
access-list SplitTunnelCloudACL extended permit ip 3.127.194.128 255.255.255.128 any4
access-list SplitTunnelCloudACL extended permit ip 3.208.72.0 255.255.255.128 any4
access-list SplitTunnelCloudACL extended permit ip 3.211.241.0 255.255.255.128 any4
access-list SplitTunnelCloudACL extended permit ip 3.235.69.0 255.255.255.128 any4
access-list SplitTunnelCloudACL extended permit ip 3.235.82.0 255.255.254.0 any4
access-list SplitTunnelCloudACL extended permit ip 3.235.71.128 255.255.255.128 any4
access-list SplitTunnelCloudACL extended permit ip 3.235.72.128 255.255.255.128 any4
access-list SplitTunnelCloudACL extended permit ip 3.235.73.0 255.255.255.128 any4
access-list SplitTunnelCloudACL extended permit ip 3.235.96.0 255.255.254.0 any4
access-list SplitTunnelCloudACL extended permit ip 4.34.125.128 255.255.255.128 any4
access-list SplitTunnelCloudACL extended permit ip 4.35.64.128 255.255.255.128 any4
access-list SplitTunnelCloudACL extended permit ip 8.5.128.0 255.255.254.0 any4
access-list SplitTunnelCloudACL extended permit ip 13.52.6.128 255.255.255.128 any4
access-list SplitTunnelCloudACL extended permit ip 13.52.146.0 255.255.255.128 any4
access-list SplitTunnelCloudACL extended permit ip host 13.114.106.166 any4
access-list SplitTunnelCloudACL extended permit ip 18.205.93.128 255.255.255.128 any4
access-list SplitTunnelCloudACL extended permit ip 50.239.202.0 255.255.254.0 any4
access-list SplitTunnelCloudACL extended permit ip 50.239.204.0 255.255.255.0 any4
access-list SplitTunnelCloudACL extended permit ip 52.61.100.128 255.255.255.128 any4
access-list SplitTunnelCloudACL extended permit ip 52.81.151.128 255.255.255.128 any4
access-list SplitTunnelCloudACL extended permit ip host 52.197.97.21 any4
access-list SplitTunnelCloudACL extended permit ip 52.202.62.192 255.255.255.192 any4
access-list SplitTunnelCloudACL extended permit ip 52.215.168.0 255.255.255.128 any4
access-list SplitTunnelCloudACL extended permit ip 64.69.74.0 255.255.255.0 any4
access-list SplitTunnelCloudACL extended permit ip 64.125.62.0 255.255.255.0 any4
access-list SplitTunnelCloudACL extended permit ip 64.211.144.0 255.255.255.0 any4
access-list SplitTunnelCloudACL extended permit ip 65.39.152.0 255.255.255.0 any4
access-list SplitTunnelCloudACL extended permit ip 69.174.57.0 255.255.255.0 any4
access-list SplitTunnelCloudACL extended permit ip 69.174.108.0 255.255.252.0 any4
access-list SplitTunnelCloudACL extended permit ip 99.79.20.0 255.255.255.128 any4
access-list SplitTunnelCloudACL extended permit ip 103.122.166.0 255.255.254.0 any4
access-list SplitTunnelCloudACL extended permit ip 109.94.160.0 255.255.252.0 any4
access-list SplitTunnelCloudACL extended permit ip 109.244.18.0 255.255.255.128 any4
access-list SplitTunnelCloudACL extended permit ip 109.244.19.0 255.255.255.0 any4
access-list SplitTunnelCloudACL extended permit ip 115.110.154.192 255.255.255.192 any4
access-list SplitTunnelCloudACL extended permit ip 115.114.56.192 255.255.255.192 any4
access-list SplitTunnelCloudACL extended permit ip 115.114.115.0 255.255.255.192 any4
access-list SplitTunnelCloudACL extended permit ip 115.114.131.0 255.255.255.192 any4
access-list SplitTunnelCloudACL extended permit ip 120.29.148.0 255.255.255.0 any4
access-list SplitTunnelCloudACL extended permit ip 160.1.56.128 255.255.255.128 any4
access-list SplitTunnelCloudACL extended permit ip 161.199.136.0 255.255.252.0 any4
access-list SplitTunnelCloudACL extended permit ip 162.12.232.0 255.255.252.0 any4
access-list SplitTunnelCloudACL extended permit ip 162.255.36.0 255.255.252.0 any4
access-list SplitTunnelCloudACL extended permit ip 165.254.88.0 255.255.254.0 any4
access-list SplitTunnelCloudACL extended permit ip 173.231.80.0 255.255.240.0 any4
access-list SplitTunnelCloudACL extended permit ip 192.204.12.0 255.255.252.0 any4
access-list SplitTunnelCloudACL extended permit ip 202.177.207.128 255.255.255.224 any4
access-list SplitTunnelCloudACL extended permit ip 202.177.213.96 255.255.255.224 any4
access-list SplitTunnelCloudACL extended permit ip 204.141.28.0 255.255.252.0 any4
access-list SplitTunnelCloudACL extended permit ip 207.226.132.0 255.255.255.0 any4
access-list SplitTunnelCloudACL extended permit ip 209.9.211.0 255.255.255.0 any4
access-list SplitTunnelCloudACL extended permit ip 209.9.215.0 255.255.255.0 any4
access-list SplitTunnelCloudACL extended permit ip 210.57.55.0 255.255.255.0 any4
access-list SplitTunnelCloudACL extended permit ip 213.19.144.0 255.255.255.0 any4
access-list SplitTunnelCloudACL extended permit ip 213.19.153.0 255.255.255.0 any4
access-list SplitTunnelCloudACL extended permit ip 213.244.140.0 255.255.255.0 any4
access-list SplitTunnelCloudACL extended permit ip 221.122.88.64 255.255.255.224 any4
access-list SplitTunnelCloudACL extended permit ip 221.122.88.128 255.255.255.128 any4
access-list SplitTunnelCloudACL extended permit ip 221.122.89.128 255.255.255.128 any4
access-list SplitTunnelCloudACL extended permit ip 221.123.139.192 255.255.255.224 any4
access-list SplitTunnelCloudACL extended permit ip 204.80.104.0 255.255.248.0 any4
access-list SplitTunnelCloudACL extended permit ip host 0.0.0.0 any4

Now that the guts of the config are in, we can enable it. If you don’t have anyconnect-custom-attr under your global webvpn command list, then you might have too old of an IOS. For the AnyConnect package itself, you’ll need at least version 4.5, but it is optimized in 4.7.

conf ter
 webvpn
 anyconnect-custom-attr dynamic-split-exclude-domains description Dynamic Split Tunneling
 anyconnect-custom-data dynamic-split-exclude-domains splitdomain_o365_teams_zoom office.com, office365.com, outlook.com, sharepoint.com, live.com, lync.com, teams.microsoft.com, broadcast.skype.com, zoom.us, cloudfront.net, MeetingConnector.IP, MeetingConnector.IP2, MeetingConnector2.IP, MeetingConnector2.IP2
 !
 group-policy gpISE_testdst attributes
 anyconnect-custom dynamic-split-exclude-domains value splitdomain_o365_teams_zoom

Now upon connecting to the new tunnel-group we click on the AnyConnect Client settings cog and are presented with proof of our efforts.

anyconnect image 2 anyconnect image 3

One thing to note: You won’t see domains populate here until the app reaches out using those FQDNs. Restart your applications.

anyconnect image 4

Now using System Explorer or Wireshark, you can see the connections are straight to the net instead of the inside proxy.