Cisco AnyConnect (Cisco Secure Client)

SSL/TLS VPN tunneling

The client builds an encrypted tunnel to a VPN headend using TLS over TCP, normally on the standard HTTPS port. Endpoint traffic selected by policy is encapsulated in that tunnel, decrypted at the gateway, and forwarded into the internal network. Because it rides on a commonly permitted port, it establishes connectivity from restrictive networks such as hotels and public hotspots.

DTLS tunneling for optimized latency-sensitive traffic

After the TLS tunnel is up, the client negotiates a second tunnel using Datagram TLS over UDP and moves data traffic onto it. Carrying packets over UDP avoids the retransmission stalls that occur when TCP traffic is tunneled inside TCP, which improves voice, video, and other latency-sensitive flows. If the UDP channel cannot be established or is lost, the client continues to carry traffic on the TLS tunnel.

IPsec IKEv2 VPN tunneling

The client can connect to a headend using IPsec with IKEv2 instead of TLS. IKEv2 negotiates the security association and keys, and the resulting ESP tunnel carries the encrypted user traffic. The tunnel protocol is chosen per connection entry in the client profile, so administrators can offer IPsec and TLS headends side by side.

Always-On VPN with automatic reconnection

Always-On keeps the VPN tunnel established whenever the endpoint is on an untrusted network, without the user choosing to connect. The client monitors the tunnel and re-establishes it automatically if it drops. Administrators can set a connect-failure policy that either blocks network traffic or permits limited open access when the headend is unreachable, and can restrict the user's ability to disconnect.

Management VPN tunnel for connectivity before user login

The client service can bring up a separate tunnel that runs independently of any user session, authenticating with a machine certificate. Because it comes up when no user is logged in, management systems can reach the endpoint to push patches, policy, and inventory jobs. This tunnel runs alongside the normal user tunnel and yields to it when the user connects.