Use the Okta system log to view your IP address when you connect to Okta, to determine if your connection is going out through the VPN connection. If it is AND if that IP address is in your "on network" list AND that list is used in a sign-in rule to control the MFA requirement, then it should work.

We also have Cisco ASA, and I have several app-level sign-in rules that prompt the user for MFA when they're off network. It's not a split-tunnel configuration, but that's really irrelevant. All that matters is the IP address that Okta sees when you sign-in.

Mike thank you - our engineerts determined that there was another layer to this:

1. They added the IPs to the ACL on the Cisco ASA - these were the IPs associated with our original org URL
2. They chatted with Cisco and determined that we also needed to add the IPs to the NAT statement
3. After completing steps # 1 and 2 the issue still persisted
4. At that time we determined that the IPs did not cover our custom URL
5. After adding the custom URL IPs to the statement the issue was fixed.
6. Here are the things that had to be done:

• Create the object group
  • AD IPs to the object group
  • Nat statement
  • ACL