Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a problem with Cisco VPN client v. 4.9.01.0180 on Mac 10.6 (Snow Leopard). I'm connecting using TCP, connection is established well, but after that my internet connection just stop working, looks like there is a problem with resolving hosts - I can ping google.com's IP but not www.google.com, also VPN connection does not work as I cannot access remote addresses.

Do you have any idea what could be wrong?

Thanks in advance!

Pavol.

share|improve this question
    
I had this issue at my previous employer. Had to update the Cisco device and configure to use AnyConnect. –  cole Aug 21 '10 at 23:39
add comment

2 Answers

This sounds like you have a problem with your DNS once the tunnel is up. If you can ping google's address, but you can't ping www.google.com, then your name server isn't providing the correct IP address. So the first thing to look at is what DNS server you get from your VPN. These are the possible scenarios:

  • your VPN doesn't provide a new DNS server. In that case all should work as if you had no VPN. Since this is not the case, we can exclude this scenario. This scenario doesn't make a lot of sense anyway, as once you are connected to the VPN you need a DNS server that can resolve names on the internal network you are connected to.
  • your VPN does provide a new DNS server, but it doesn't respond to your queries. There are several possible reasons for this:
    • there is a firewall in the way. In that case you cannot ping the name server.
    • the server is limited to responses from the LAN. Your VPN connection usually is provided by way of tunnels, in which case your client will have an IP address that is in a subnet not otherwise used on the LAN. In that case you cannot even resolve names of hosts on the LAN.
    • the server only provides answers for the LAN. In that case internal names are resolved just fine, but any external names are not resolved at all.

In all of the above three plausible scenarios you need to talk to your LAN system admins, to check out the problem. If you are the LAN system admin, you can use nslookup or dig to figure out which of the above is the correct scenario and then reconfigure your firewalls or DNS servers to handle it correctly.

share|improve this answer
add comment

I have good news for you. You do NOT need the Cisco client on Snow Leopard! It is now built into the OS and I use it everyday to connect to my work VPN.

Go to System Preferences, Network and add a new VPN of type Cisco and give it a name of your choice.

Then, enter the server address. In my case it is vpn1.mycompany.com. Also enter your account name (this is your user name). I left the password field empty since we have an RSA token and it changes every few minutes. If your password always stays the same, put it in.

Then this is where it gets interesting. Go to Authentication Settings. You have to enter the "Shared Secret". You can find it in your Cisco client configuration file (which is plain text). The only problem is that it is encrypted. To decrypt it, simply go to Cisco vpnclient password decoder and paste your encrypted shared secret. Once you have the decrypted string, just paste it. You also need to enter the Group Name which can also be found in the Cisco config file.

That's it! You can now connect to your VPN without the crappy Cisco client!

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.