Windows – Cisco AnyConnect vpn stops internet connection in Windows 8

cisco-vpn-clientdnsroutingvpnwindows 8

I have a VPN set up through Cisco AnyConnect 3.1.04072 on a Windows 8 laptop. I can connect to the vpn, but as soon as I do, all internet traffic stops. I've been researching for days now and I haven't found a solution. A few suggestions I found included unchecking "Use default gateway on remote network" in properties, updating drivers, and editing a key in regedit.

We have three machines that use AnyConnect (a Mac, a Win7, and my Win8) with the same vpn service and mine is the only one with this problem. Also, it began only a few days ago when Cisco released the 3.1.04072 update.

Here's the configuration…

Windows IP Configuration

Ethernet adapter Ethernet 2:

   Connection-specific DNS Suffix  . : studentsolutions.org
   Description . . . . . . . . . . . : Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows x64
   Physical Address. . . . . . . . . : 00-05-9A-3C-7A-00
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::dab:ae7:bbd7:359b%50(Preferred)
   Link-local IPv6 Address . . . . . : fe80::8d58:7076:5587:59b9%50(Preferred)
   IPv4 Address. . . . . . . . . . . : 192.168.247.152(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.224
   Default Gateway . . . . . . . . . : ::
                                       192.168.247.129
   DHCPv6 IAID . . . . . . . . . . . : 838862234
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-18-63-E5-A0-B8-88-E3-EA-82-47

   DNS Servers . . . . . . . . . . . : 172.16.1.200
   NetBIOS over Tcpip. . . . . . . . : Enabled

Wireless LAN adapter Wi-Fi:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Intel(R) Centrino(R) Wireless-N 2230
   Physical Address. . . . . . . . . : 60-36-DD-43-86-A4
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::9a9:3e90:9529:a776%38(Preferred)
   IPv4 Address. . . . . . . . . . . : 192.168.2.106(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Lease Obtained. . . . . . . . . . : Tuesday, December 17, 2013 6:13:47 PM
   Lease Expires . . . . . . . . . . : Wednesday, December 18, 2013 7:41:12 PM
   Default Gateway . . . . . . . . . : 192.168.2.1
   DHCP Server . . . . . . . . . . . : 192.168.2.1
   DHCPv6 IAID . . . . . . . . . . . : 207632093
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-18-63-E5-A0-B8-88-E3-EA-82-47

   DNS Servers . . . . . . . . . . . : 192.168.2.1
   NetBIOS over Tcpip. . . . . . . . : Enabled

Tunnel adapter isatap.studentsolutions.org:

   Connection-specific DNS Suffix  . : studentsolutions.org
   Description . . . . . . . . . . . : Microsoft ISATAP Adapter #13
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::5efe:192.168.247.152%47(Preferred)

   Default Gateway . . . . . . . . . :
   DNS Servers . . . . . . . . . . . : 172.16.1.200
   NetBIOS over Tcpip. . . . . . . . : Disabled

Here's what the routing table looks like without the vpn:

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.2.1    192.168.2.106     25
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
    192.168.2.106  255.255.255.255         On-link     192.168.2.106    281
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link     192.168.2.106    281
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link     192.168.2.106    281
===========================================================================
Persistent Routes:
  None

IPv6 Route Table
===========================================================================
Active Routes:
 If Metric Network Destination      Gateway
 16    306 ::/0                     On-link
  1    306 ::1/128                  On-link
 16    306 2001::/32                On-link
 16    306 2001:0:9d38:6ab8:2892:2af2:3f57:fd95/128
                                    On-link
 16    306 fe80::/64                On-link
 38    281 fe80::9a9:3e90:9529:a776/128
                                    On-link
 16    306 fe80::2892:2af2:3f57:fd95/128
                                    On-link
  1    306 ff00::/8                 On-link
 16    306 ff00::/8                 On-link
 38    281 ff00::/8                 On-link
===========================================================================
Persistent Routes:
  None

And here's what happens after I connect to the vpn:

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.2.1    192.168.2.106     25
          0.0.0.0          0.0.0.0  192.168.247.129  192.168.247.152      2
     64.111.25.65  255.255.255.255      192.168.2.1    192.168.2.106     26
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
      192.168.2.1  255.255.255.255         On-link     192.168.2.106     26
    192.168.2.106  255.255.255.255         On-link     192.168.2.106    281
    192.168.214.0    255.255.255.0      192.168.2.1    192.168.2.106     25
    192.168.215.0    255.255.255.0      192.168.2.1    192.168.2.106     25
    192.168.216.0    255.255.255.0      192.168.2.1    192.168.2.106     25
  192.168.247.128  255.255.255.224         On-link   192.168.247.152    257
  192.168.247.152  255.255.255.255         On-link   192.168.247.152    257
  192.168.247.159  255.255.255.255         On-link   192.168.247.152    257
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link     192.168.2.106    281
        224.0.0.0        240.0.0.0         On-link   192.168.247.152    257
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link     192.168.2.106    281
  255.255.255.255  255.255.255.255         On-link   192.168.247.152    257
===========================================================================
Persistent Routes:
  Network Address          Netmask  Gateway Address  Metric
          0.0.0.0          0.0.0.0  192.168.247.129       1
===========================================================================

IPv6 Route Table
===========================================================================
Active Routes:
 If Metric Network Destination      Gateway
 50     41 ::/0                     On-link
  1    306 ::1/128                  On-link
 50    296 fe80::/64                On-link
 47    306 fe80::5efe:192.168.247.152/128
                                    On-link
 38    281 fe80::9a9:3e90:9529:a776/128
                                    On-link
 50    296 fe80::dab:ae7:bbd7:359b/128
                                    On-link
 50    296 fe80::8d58:7076:5587:59b9/128
                                    On-link
  1    306 ff00::/8                 On-link
 38    281 ff00::/8                 On-link
===========================================================================
Persistent Routes:
  None

Pinging the DNS server 172.16.1.200 is unsuccessful. I've tried changing the DNS server in the control panel properties to other things like google's DNS, but the result is the same. All pings fail, as does tracert and nslookup:

>nslookup    
DNS request timed out.
timeout was 2 seconds.
Default Server:  UnKnown
Address:  172.16.1.200

If someone could point me in the right direction I would really appreciate it!

Best Answer

Disable IPv6 on your Microsoft PC under the "Local Area Connection" within "Network and Sharing Center" and get back to me. This has worked on three of our computers all with different OS's.

Related Solutions

Resetting gone wrong

You have Teredo enabled, but your system hasn't correctly identified your public IPv4 address. This is due to a double NAT situation (you are behind two home routers both doing NAT, or you have one router and your ISP is also NATting your connection); Teredo addresses encode what should be the public IPv4 address, but yours encodes the address 192.168.1.100, a private address. This only happens in a double NAT setup.

Since this gives you a mostly-nonfunctional or completely broken IPv6 address, and IPv6 is preferred to IPv4, this will slow down your connectivity to any IPv6 enabled web site (Google, Facebook, many others).

I always recommend disabling Teredo, ISATAP and 6to4, all of which are IPv6 transition technologies with various pitfalls, unless you actually intend to use them.

Open an elevated command prompt by right-clicking the Command Prompt icon and selecting Run as Administrator, and enter the following commands:

netsh int ipv6 isatap set state disabled
netsh int ipv6 6to4 set state disabled
netsh int teredo set state disabled

Each should return The command completed successfully.

Then restart your computer.

Linux – Routing all traffic over VPN on Ubuntu Linux

Your local network is 192.168.1.0/24, as shown by this line in your routing table:

 192.168.1.0/24 dev eth0  proto kernel  scope link  src 192.168.1.32  metric 1

Your VPN network is 10.0.0.0/8, as shown by this line:

 10.0.0.0/8 dev tun0  scope link

Currently, your default router is:

 default via 192.168.1.254 dev eth0  proto static

which is of course what you do not want, because it belongs to your local LAN: thus all of your stuff is routed through your local gateway, as if the VPN did not exist.

 You do have however, the all-important statement

 128.122.252.68 via 192.168.1.254 dev eth0  src 192.168.1.32

which is the route to your VPN-provider.

EDIT:

I had not realized that the routing table is simply the one that is obtained from your VPN, without your intervention. This may indicate (indirectly) that your service provider is willing to forward only the traffic explicitly allowed in your table through the interface tun0, and may have taken further steps to block all other traffic, in which case your efforts will be futile.

However, assuming that your provider is willing to forward all of your traffic, what you need to do is the following.

First, you need to find out whether there is a gateway willing to accept your connection on the other side, because we need its IP address. I will give you four methods to do this.

1) With the pc connected to the VPN, try the following command:

   sudo dhclient -v tun0

If everything goes well, you should see a reply containing this line:

 DHCPOFFER of a.b.c.d from x.y.w.z

x.y.w.z is the IP address of the local gateway. You may have to shutdown your VPN after this test, and maybe even to reboot your pc, because we will have just messed up the routing table pretty well.

2) Alternatively, you may try navigating to one of the allowed sites (those that appear in your routing table as going through the tun0 interface), then issuing the command:

  ip neigh show

You should get a list of pcs contacted through the ARP protocol, with MAC and IP address; most likely, you will receive either zero or one reply. If you get a single reply, then that's your router.

3) If you get no such reply, then you may try with

  sudo nmap -sn 10.0.0.0/8

(which is going to be very slow). Your gateway will be one of the pcs listed, most likely the one with address ending in .1 or in .254, if any such exist.

4) Use the tcpdump command:

  sudo tcpdump -n -i tun0

and see the IP addresses spewed out by the command.

If you get no proper reply to this test either, it means someone has really tightened the screws in his network.

But let us be optimistic, and suppose you now have a candidate IP address x.w.y.z for the remote router. You will need to delete the default gateway, (as sudo!):

  ip route del default via 192.168.1.254

an add the new one:

  ip route add default via x.w.y.z

and try to navigate.

Let me repeat: since your provider has allowed traffic only to a few selected IP addresses through his VPN, it is possible he may have taken extra measures (=firewall) to prevent a smart user to force his generic traffic through his VPN. In this case, there is nothing you can do. But if he did not, the above steps should help you find a solution.

Best Answer

Related Solutions

Resetting gone wrong

Linux – Routing all traffic over VPN on Ubuntu Linux

Related Question