Letting end user enable full or split tunnel on AnyConnect client

[JordanCN]

I have some user where they want to be sure all their traffic flows through the VPN when they travel to places around the world that might have less than stellar privacy standards.  (Unlike the wonderful privacy standards we have here in the US - LOL)

Currently using version 5.0 of the AnyConnect client with our MX devices.  Using Radius authentication with certs.

I am using a split tunnel setup for my clients. I have my AnyConnect client configs for my MX devices setup with the following on the dashboard:

• Client Routing:
  Only send traffic to these destinations: (my local LAN network addresses)
• Dynamic Client Routing:
  Only send traffic going to these destinations: (List of web addresses)
  

So is there a way to configure the local AnyConnect client so they use my split tunnel config as the default, but be able to turn on full tunneling on their own?  I took a look at the VPN Profile Editor settings, but did not see (or missed) a settings to allow end users to do this.

[alemabrahao · Accepted solution]

No, there is no way, it's defined on the dashboard configuration.

[PhilipDAth]

You could consider getting a Teleworker gateway, the Z4, and run that in full tunnel mode.  Have them use that when they travel.

https://documentation.meraki.com/MX/MX_Overviews_and_Specifications/Z4_Datasheet 

[JordanCN]

Hi Phillip,

I use the older Z1 devices now for my home office and some others, but it would be very cumbersome for the team to take them on the road and very expensive for each home office.

Thanks for the suggestion.