A 60-person contractor program must connect with the Cisco Secure Client client on company laptops, authenticate against the internal RADIUS server, and reach only internal application subnets while personal internet traffic stays local. The same FTD must also build an IKEv2 tunnel to a branch office peer. Which FMC VPN configuration fits both requirements?
Select an answer to reveal the explanation.
Short Explanation
Split tunneling is the piece people forget, and it is what keeps contractor streaming traffic off the corporate tunnel while the app subnets still come through. Your remote access profile pairs RADIUS authentication with an Cisco Secure Client connection profile, and the branch gets its own IKEv2 site-to-site policy. Both policies live in the same Management Center.
Full Explanation
A remote access VPN policy in the Management Center ties together the Cisco Secure Client connection profile, the AAA server that authenticates users, and the group policy that decides which networks enter the tunnel. Configuring the internal RADIUS server keeps contractor authentication with the directory instead of using local accounts, and split tunneling sends only the internal application subnets through the FTD while everything else leaves the laptop locally. The site-to-site side is a separate policy with IKEv2 proposals and a matching pre-shared key or certificate against the branch peer, so both needs are met on one device without interfering. Choosing local password authentication misses the RADIUS requirement, because accounts would have to be created and maintained in the local user database. Full tunneling keeps the client and authentication facts intact but misses split tunneling by pushing all contractor internet traffic through the data center. Staying with IKEv1 for the branch misses the required IKEv2 key exchange, so the tunnel does not meet the stated requirement. Exam caveat: menu locations for these policies shift between releases, so anchor on the objects that must match on both ends. Practical check: after deployment, confirm an internal app resolves through the tunnel while an external site resolves through the local gateway.