I am looking for a deep down technical explanation of how it works.

My understanding is its an SSL VPN and works as follows:

- Anyconnect creates a TLS session to the configured remote servers, authenticate the user and fetch some network details like the IP address 

- sets a local tunnel interface with that IP

- configures the routing on the host to point all traffic to the tunnel.

Assuming this is correct, how does the tunnel interface packets get sent over the TLS connection ?

One of the mentioned advantages of SSL VPN over IPSec VPN is that the former doesn't need a client software. If Cisco Anyconnect has to be installed anyway is there still an advantage with SSL VPNs ?

  • Can you clarify what you mean by "One of the mentioned advantages of SSL VPN over IPSec VPN is that the former doesn't need a client software. If Cisco Anyconnect has to be installed anyway is there still an advantage with SSL VPNs ?" Commented Aug 11, 2018 at 23:39

2 Answers 2


I think the common descriptions of "SSL VPNs" conflate three different things:

  1. VPNs which use TLS or DTLS as their base protocol. (Examples: AnyConnect, SSTP, arguably even OpenVPN.) These still require a client just like any other protocol does – there's nothing magic about the usage of SSL/TLS here, and no great advantage (except perhaps passing through IDS systems unnoticed).

  2. VPNs which, regardless of protocol being used, launch a JavaWS or ClickOnce applet directly from a website. Now that's still technically a client, just one that doesn't have to be explicitly installed. I don't get why people call this kind "SSL VPNs" (is it because the client runs from a HTTPS website?), but they do it anyway.

  3. Finally, "VPNs" which aren't actually IP-layer VPNs but merely web-based gateways (proxies; portals) to internal webapps. These don't require a dedicated client because they don't actually intercept IP packets from the OS – they work like ordinary websites that you visit over HTTPS (therefore SSL).

So what makes things confusing is that the same Cisco AnyConnect product can fit any of these descriptions: its protocol is based on DTLS; it provides a Java-applet client; and it provides a webapp gateway in addition to traditional VPN.

But that doesn't mean the same mode fits all three descriptions at once: e.g. if you want to use the system-wide VPN mode, it still requires a client that runs on the local computer, creates a virtual interface, and so on.


Cisco AnyCconnect is SSL VPN. There is also client-less WebVPN where you browse to an internal site on the ASA, authenticate just like you're using AnyConnect, but then you access internal servers via that web portal. The advantage is that your entire connction isn't tunneled - it's only whatever you access through the web portal. For example, you select Telnet, HTTP(s), RDP, SSH from a drop-down field and then tell it the IP or name you want to connect to on the webpage.

Cisco has another client called Cisco VPN Client which is an IPSEC client. Still for client remote access but just using IPSEC instead. The advantage is that ASAs come with licensing for IPSECright off the bat, whereas you have to purchase Cisco APEX licensing I order to use AnyConnect. It gets pricey.

A disadvantage to using Cisco VPN Client instead of AnyConnect is that it isn't compatible with Windows 10 and up. You have to do some hacks involving SonicWall's VPN client or use something else like Shrewsoft VPN instead.

  • Anyconnect creates a tunnel interface with the IP received from the VPN gateway and sets up a default route for all packets to be routed to the tunnel interface. But how does the clients packets routed to the tunnel interface plumbed to the TLS session ? In the case of Linux client, is it done using Linux kernel networking features or its implemented in the user space ?
    – Manohar
    Commented Aug 12, 2018 at 7:51
  • @Manohar Your statement about the default route is not accurate. You CAN tunnel all traffic but you can also do what is called "split-tunnel" where only traffic for the subnets "advertised" over the tunnel are sent through it while then using the user's internet connection for the rest of the traffic. For example, browsing the internet would use your internet connection rather than the internet connection on the ASA (at your office). I don't know the answer to the question about whether this is done in kernel or user space.
    – Jesse P.
    Commented Aug 12, 2018 at 13:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .