Yes, you are correct in your confirmation of what I want to do, but I dont understand what I need to add to the configuration to allow me to do this.....

Do I basically replicate the configuration that I already have but point it at the loopback interface, or are there elements of the existing configuration that I can reuse so I'm not doubling up on items?

I can not open the link that you have provided me - its coming up with 'forbidden file or application' - even though I have a full smart net contract !!

For example, you currently have this group:

crypto isakmp client configuration group ezvpn
key XXX
pool SDM_POOL_1
max-users 5
max-logins 1

You can create another group (will be another PCF file)

crypto isakmp client configuration group new_tunnel
key new_tunnel123
pool SDM_POOL_2
max-users 5
max-logins 1

With the above configuration, you can connect using two VPN groups.
The first group will connect with group name ezvpn and password XXX
The second group will connnect with group name new_tunnel and password new_tunnel123

When you apply an ACL to a group, for example, to the second group:

crypto isakmp client configuration group new_tunnel
key new_tunnel123
pool SDM_POOL_2
max-users 5
max-logins 1
acl 101

The ACL 101 will indicate which traffic is to be encrypted through the tunnel (split-tunneling)
So, pretty much based on the ACLs and the VPN groups, you can manipulate what the VPN clients can do.

About the ISAKMP profiles, you can search on Google for an explanation as well.

Federico.

Robert

The link Federico provided is a partner link, just substitute /partner/ with /customer/ ie.

http://www.cisco.com/en/US/customer/prod/collateral/iosswrel/ps6537/ps6586/ps6635/prod_white_paper0900aecd8034bd59.html

Jon