We have a machine for connecting via Cisco SSL VPN (
i can ping our our
The routing table on
\\speeder shows the multiple IP addresses we have assigned to it:
After connecting with the Cisco AnyConnect VPN client:
we can no longer ping
And while there are new routing entries for the Cisco VPN adapter, no existing routing entries were modified after connection:
It is to be expected that we cannot ping Speeder’s IP address on the Cisco VPN adapter (192.168.199.20) because it is on a different subnet than our network (we are 10.0.x.x 255.255.0.0), i.e.:
C:\Users\ian.AVATOPIA>ping 192.168.199.20 Pinging 192.168.199.20 with 32 bytes of data: Request timed out.
The problem we are experiencing is that we then cannot ping existing IP addresses on
C:\Users\ian.AVATOPIA>ping 10.0.1.17 Pinging 10.0.1.17 with 32 bytes of data: Request timed out. C:\Users\ian.AVATOPIA>ping 10.0.1.22 Pinging 10.0.1.22 with 32 bytes of data: Request timed out. C:\Users\ian.AVATOPIA>ping 10.0.1.108 Pinging 10.0.1.108 with 32 bytes of data: Request timed out.
What’s interesting, and might provide a clue, is that there is one address we can communicate with:
This address we can ping and communicate with:
C:\Users\ian.AVATOPIA>ping 10.0.1.4 Pinging 10.0.1.4 with 32 bytes of data: Reply from 10.0.1.4: bytes=32 time<1ms TTL=128
What makes this one IP address special? This one IP address has the virtue of being a “main” address:
As opposed the addresses we use, which are “additional” addresses:
To sum up, when the Cisco AnyConnect VPN client connects, it blocks us from all-but-one address associated with the computer.
We need the Cisco Client to stop doing that.
Does anyone know how to make Cisco AnyConnect SSL VPN client stop doing that?
Note: Firepass SSL VPN from F5 Networks does not suffer the same issue.
We've contacted Cisco, and they say that this configuration is not supported.