3

I frequently work remotely, out of reach of WiFi, and simply rely on tethering my Mac to my iPhone for internet access. This works great, except I am unable to connect to one of my client's Cisco AnyConnect VPN Network using my Mac when tethered to my iPhone. I have spent three years vaguely looking for a solution and the last 48 hours trying solidly, so would be grateful for help.

To be clear:

  • MacOSX connected to Anyconnect VPN via wifi internet works fine.
  • MacOSX connected to VPN via tether to a Samsung S7 LTE works fine
  • MacOSX connected to VPN via tether to an iPhone, via either Lighting USB or Wifi does not work

By "doesn't work" I mean that I have no internet access whatsoever (chrome displays DNS_PROBE_FINISHED_NO_INTERNET when accessing any website.) Internet access is restored upon disconnecting to VPN.

Also interestingly:

  • VPN from Windows 10, connected via any of the above (WiFi, Samsung, iPhone) works fine from both a Macbook running Win10, and a Surface 3. This implies that if ports are blocked by iPhone Personal Hotspot, this somehow isn't an issue for the Windows Client, but is for the OSX AnyConnect Client.
  • VPN Directly on the iPhone (via Cisco AnyConnect iOS App works fine) but does not change the inability to connect my mac.

Things I have already tried:

  • I tried setting up MacOSX builtin Cisco VPN support in Apple Network Settings, but I don't see where my profile file is stored to allow specifying a groupname or password (following instructions to find a PCF file in /opt/cisco etc). To be clear, I have confirmed that on a clean Surface 3, all that is necessary is to download the Cisco VPN installer from the company website, and specify remote.companyname.com as the server in AnyConnect. I never download a personal certificate file or similar from which a group key can be decrypted. Are there more up to date instructions on how to do this? I can confirm that on a if a group name/password is available, the company have declined to provide it, and I don't understand why OpenConnect (below) would be able to connect without it if it is required.

  • I tried connecting using OpenConnect installed via Macports, which seemed to authenticate correctly (including the company's 2 factor authentication via Duo Push), but I have no DNS for internal sites (jira confluence etc.) To be clear, the result is different to other failed tethered connections in that I DO have access to the wider internet.

  • Some web pages implied that UDP ports used by IPSec are blocked on IPhone Personal hotspot. However, I can find no option in anyConnect to fall back to TCP as suggested. Perhaps the fact that the Windows AnyConnect client DOES work implies that it does that automatically?

  • I have not called my cellphone carrier, as Windows VPN connections demonstrably work via tether to the iPhone.

I have been looking for a solution to this for 3 years. Currently, my best solution is a Microsoft Surface that I keep with me (updating Confluence/JIRA from an iPhone is inconvenient.) The internet is full of vague questions regarding this over the past 6 years, so I have tried to be as specific as possible.

(Originally posted on ServerFault, where it was put on hold and I was told to post here. Sorry. I am an engineer, so if you need to ask me to explain further or test something, I'll be happy to report back.)

| improve this question | | | | |
  • Yes, but it's even more specific than that. I can access the internet after establishing AnyConnect VPN on all combinations of machines and connections except for Mac when tethered to iPhone. The same Mac is fine when connected to the VPN via a Samsung S7 (Android phone), or any WiFi network. – Alex Ferrier Aug 5 '16 at 0:06
  • OSX El Capitan, AnyConnect 3.1.08009 and 3.1.14018 (I've also tried a 4.2 version, but no longer have exact build number.) Cisco iOS version is doesn't matter for this discussion (it was only a separate observation that the phone can connect itself, but for the case of connecting the Mac to AnyConnect via iPhone, the phone is just a router and its connection to VPN is no more required than any other router needs to know about the VPN for you to connect through it.) We do not expect to get further information from the server team, or changes in the configuration of the network. – Alex Ferrier Aug 5 '16 at 4:01
  • 1
    No luck. IPv6 sounds like a possible explanation. I could disable IPv6 on my Mac using networksetup -setv6off "Wi-Fi", but there is no way to disable IPv6 on an iPhone (as far as I can google). Results unchanged. – Alex Ferrier Aug 5 '16 at 5:58
  • Yes, disable on your Mac and see if that makes any difference – Pimp Juice IT Aug 5 '16 at 6:01
  • That's what I did, and it makes no difference (presumably because the iPhone Personal Hotspot is still IPv6?) – Alex Ferrier Aug 5 '16 at 6:02
0

It seems that others have experienced this problem and have been able to workaround it by disabling the IPv6 functionality on the devices which are affected by this issue.

In cases where a device only uses IPv6 or it cannot be forced to use IPv4, then you can configure the Cisco router to have the client-bypass-protocol "enabled" so the IP address type is not dropped when it uses IPv6.

The issue may be related to inherited DNS names when connected to an Anyconnect VPN tunnel where Split Tunneling is defined.

If possible, have the network team check the Cisco router logs when a device affected by this problem is connected to the Anyconnect VPN tunnel and see what the logs show.

Cisco ASA Series Command Reference, A - H Commands

client-bypass-proxy

To configure how the ASA manages IPv4 traffic when it is expecting only IPv6 traffic or how it manages IPv6 traffic when it is expecting only IPv4 traffic, use the client-bypass-proxy command in group-policy configuration mode. To clear the client bypass protocol setting, use the no form of this command.

client-bypass-protocol { enable | disable }

no client-bypass-protocol { enable | disable }

Syntax Description

  • enable: If Client Bypass Protocol is enabled, the IP traffic for which the ASA did not assign an IP address type is sent from the client in the clear.
  • disable: If Client Bypass Protocol is disabled, the IPv6 traffic for which the ASA did not assign an IP address type is dropped.

Defaults

  • Client Bypass Protocol is disabled by default in the DfltGrpPolicy.

source


| improve this answer | | | | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.