Using the Cisco VPN 5.0.07 blocks internet - but shouldn't

Question

I have been bashing my head against this for a few days. I have a computer that is singularly running the Cisco VPN client to connect for a work application. Our web normally filters through a proxy on the network.

When the client is not connected, the web works fine. When the client is connected, no internet access works at all. Pinging/trace-routing return the correct IP address for the website, even when connected.

I have tried many things so far, but no one has a direct answer. The rub - when I try the same credentials on a identicle computer that is not behind the proxy it has no issues pulling the web.

I tracked some data, and the trace route will go through the LAN gateway, and isn't trying to go through the tunnel, but I think the client is still trying to capture HTTP data.

Does anyone have a place to start with this? Please let me know if I need to get more information.

Answer 1

Cisco VPN gives your employer (or your administrator) option to leave default "split horizon" option (packets to company's servers go through VPN, packets to the Internet go straight), or disable it (everything goes through VPN and company's proxy, firewall etc.).

This is done via local routing table manipulation.

The most probable reason of described behaviour is that your computer configuration is non-typical in some way, while your administrator configured some routing options and didn't test them properly, so they work on computers with standard configuration, while don't on others.

What you can do about it:

1. Go to your administrator and complain about it.

2. Use open source "vpnc" client instead of original Cisco VPN - it should work regardless of your VPN configuration, however you will have to configure it manually.

When you use "vpnc", it also does the same routing manipulation as Cisco VPN. However "vpnc" does it via external shell script, which you can modify to ignore commands from VPN server (search for lines beginning with "route" or "ip route" commands and change them to your needs).

And if you use Windows, you can install "vpnc" on virtual machine (eg. Ubuntu on VirtualBox), and then on Windows add static routing to company IP address ranges through virtual machine IP.