0

I have a anyconnect remote vpn profile where I am having the problem with intermittent issue with external dns. I can not open any external weblink and cant ping it with name but accessing them with ip is fine.

I opened a case with cisco but they are unable to give a proper answer or workaround for the issue I am seeing. I am using split tunnel and split dns in my group-policyconfigurations.

Can someone please help and tell me if there is something I am missing out?

Here is vpn config from firewall:

vpnfw1a# sh run all group-po abc_vpnPolicy
group-policy abc_vpnPolicy internal
group-policy abc_vpnPolicy attributes
banner value WARNING: Unauthorized access to this system is forbidden and
banner value will be prosecuted by law. By accessing this system
banner value you agree that your actions are monitored and recorded.
dns-server value 10.1.1.11
vpn-simultaneous-logins 2
vpn-idle-timeout 1440
vpn-session-timeout none
vpn-filter value abc_vpnVPN
vpn-tunnel-protocol ikev1 ssl-client
group-lock value abc_vpn
ipsec-udp enable
split-tunnel-policy tunnelspecified
split-tunnel-network-list value abc_vpnNetworks
default-domain none
split-dns value abc.partners jira.abc.com confluence.abc.com 
user-authentication enable
webvpn
 anyconnect keep-installer installed
 anyconnect ssl rekey method none
 anyconnect dpd-interval client 10
 anyconnect dpd-interval gateway 30
 anyconnect modules value dart
 anyconnect profiles value abc_vpn-profile type user
 anyconnect ask enable

Tunnel group all config:

vpnfw1a# sh run tunnel-group abc
tunnel-group abc type remote-access
tunnel-group abc general-attributes
 address-pool abcVpnPool
 authentication-server-group RADIUS
 default-group-policy abcPolicy
tunnel-group abc webvpn-attributes
 authentication aaa certificate
 group-alias abc enable
Improve this question
4
  • Is the client able to ping the DNS server while resolution isn't working? If yes, what happens when you nslookup?
    – Zac67 ♦
    Jun 26, 2017 at 14:45
  • Hi [zac67] to answer your yes I have tried all those but I have found the resolution and issue was with ipv6, somehow the dns fallsback and was going for ipv6 lookup which doesn't complete ever. So I disabled ipv6 on one machine and started working.. to push it to globally we used [client-bypass-protocol] and it actually ignores the ipv6 if its not configured on vpn.
    – Rsingh
    Jun 26, 2017 at 22:58
  • Great! You should mark your own answer as answer for future readers and to keep this question from popping up.
    – Zac67 ♦
    Jun 27, 2017 at 6:18
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Aug 27, 2017 at 17:28

1 Answer 1

Reset to default
0

I have found the resolution and issue was with ipv6, somehow the dns fallsback and was going for ipv6 lookup which doesn't complete ever. So I disabled ipv6 on one machine and started working.. to push it to globally we used client-bypass-protocol and it actually ignores the ipv6 if its not configured on vpn.

this is the bug CSCtf20226and CSCtz86314 cisco addressed them in enter link description here

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.