Whenever I connect to a VPN server using the Cisco AnyConnect Secure Mobility Client v. 3.0.4235 (probably also with other versions) I lose access to my LAN. I hope to remedy this by manually adding some routes which AnyConnect deletes.
Below is my setup, routes before and after connection. I have a machine with two physical NICs:
NIC1 Gateway to internet
Address 10.191.244.10
Mask 255.255.255.0
Gateway: 10.191.244.1
NIC2
Address 172.16.97.1
Mask 255.255.0.0
Gateway: N/A
Device attached to NIC2
Address 192.16.97.2
Mask 255.255.0.0
Gateway: N/A
EDIT: Please note that the VPN connection and the LAN connection is not on the same physical NIC/link, and the two NICs do not connect to the same network (one connects to 10.191.244.0/24 and the other to 172.16.97.0/20).
Routes and ARP table before connection to VPN
===========================================================================
Interface List
15...52 54 00 c3 42 45 ......Red Hat VirtIO Ethernet Adapter #2
14...52 54 00 f4 a4 80 ......Red Hat VirtIO Ethernet Adapter
1...........................Software Loopback Interface 1
11...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
12...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
13...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2
===========================================================================
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 10.191.244.1 10.191.244.11 261
10.191.244.0 255.255.255.0 On-link 10.191.244.11 261
10.191.244.11 255.255.255.255 On-link 10.191.244.11 261
10.191.244.255 255.255.255.255 On-link 10.191.244.11 261
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
172.16.0.0 255.255.0.0 On-link 172.16.97.1 261
172.16.97.1 255.255.255.255 On-link 172.16.97.1 261
172.16.255.255 255.255.255.255 On-link 172.16.97.1 261
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 10.191.244.11 261
224.0.0.0 240.0.0.0 On-link 172.16.97.1 261
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 10.191.244.11 261
255.255.255.255 255.255.255.255 On-link 172.16.97.1 261
===========================================================================
Persistent Routes:
Network Address Netmask Gateway Address Metric
0.0.0.0 0.0.0.0 10.191.244.1 Default
===========================================================================
## ARP ##
Interface: 10.191.244.11 --- 0xe
Internet Address Physical Address Type
10.191.244.1 c4-05-28-c9-fd-63 dynamic
10.191.244.20 00-c0-3d-00-53-0d dynamic
10.191.244.255 ff-ff-ff-ff-ff-ff static
224.0.0.22 01-00-5e-00-00-16 static
224.0.0.251 01-00-5e-00-00-fb static
224.0.0.252 01-00-5e-00-00-fc static
239.255.255.250 01-00-5e-7f-ff-fa static
Interface: 172.16.97.1 --- 0xf
Internet Address Physical Address Type
172.16.97.2 00-80-2f-17-26-06 dynamic
172.16.97.3 00-80-2f-17-6a-44 dynamic
172.16.255.255 ff-ff-ff-ff-ff-ff static
224.0.0.22 01-00-5e-00-00-16 static
224.0.0.251 01-00-5e-00-00-fb static
224.0.0.252 01-00-5e-00-00-fc static
239.255.255.250 01-00-5e-7f-ff-fa static
Routes and ARP after connection to VPN
===========================================================================
Interface List
16...00 05 9a 3c 7a 00 ......Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows x64
15...52 54 00 c3 42 45 ......Red Hat VirtIO Ethernet Adapter #2
14...52 54 00 f4 a4 80 ......Red Hat VirtIO Ethernet Adapter
1...........................Software Loopback Interface 1
11...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
12...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
13...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2
17...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #3
===========================================================================
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 10.191.244.1 10.191.244.11 261
0.0.0.0 0.0.0.0 192.168.220.1 192.168.221.131 2
10.191.244.11 255.255.255.255 On-link 10.191.244.11 261
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
172.16.97.1 255.255.255.255 On-link 172.16.97.1 261
192.168.220.0 255.255.254.0 On-link 192.168.221.131 257
192.168.221.131 255.255.255.255 On-link 192.168.221.131 257
192.168.221.255 255.255.255.255 On-link 192.168.221.131 257
193.28.147.7 255.255.255.255 10.191.244.1 10.191.244.11 6
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 10.191.244.11 261
224.0.0.0 240.0.0.0 On-link 172.16.97.1 261
224.0.0.0 240.0.0.0 On-link 192.168.221.131 257
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 10.191.244.11 261
255.255.255.255 255.255.255.255 On-link 172.16.97.1 261
255.255.255.255 255.255.255.255 On-link 192.168.221.131 257
===========================================================================
Persistent Routes:
Network Address Netmask Gateway Address Metric
0.0.0.0 0.0.0.0 10.191.244.1 Default
0.0.0.0 0.0.0.0 192.168.220.1 1
===========================================================================
## ARP ##
Interface: 10.191.244.11 --- 0xe
Internet Address Physical Address Type
10.191.244.1 c4-05-28-c9-fd-63 dynamic
10.191.244.20 00-c0-3d-00-53-0d dynamic
224.0.0.22 01-00-5e-00-00-16 static
224.0.0.251 01-00-5e-00-00-fb static
224.0.0.252 01-00-5e-00-00-fc static
239.255.255.250 01-00-5e-7f-ff-fa static
Interface: 172.16.97.1 --- 0xf
Internet Address Physical Address Type
172.16.97.2 00-80-2f-17-26-06 dynamic
172.16.97.3 00-80-2f-17-6a-44 dynamic
224.0.0.22 01-00-5e-00-00-16 static
224.0.0.251 01-00-5e-00-00-fb static
224.0.0.252 01-00-5e-00-00-fc static
239.255.255.250 01-00-5e-7f-ff-fa static
Interface: 192.168.221.131 --- 0x10
Internet Address Physical Address Type
192.168.220.1 00-11-22-33-44-55 dynamic
192.168.221.255 ff-ff-ff-ff-ff-ff static
224.0.0.22 01-00-5e-00-00-16 static
224.0.0.251 01-00-5e-00-00-fb static
224.0.0.252 01-00-5e-00-00-fc static
239.255.255.250 01-00-5e-7f-ff-fa static
The differences in routes before and after show that AnyConnect deleted a route to the 172.16.0.0 network.
I try to add it back with
route ADD 172.16.0.0 MASK 255.255.0.0 172.16.97.1
The route utility returns/prints "OK!", but the route never shows up in the routing table afterwards. I run the route utility with elevated privileges. Can AnyConnect block my addition of new routes?
Is there any way around this issue on my (client) end? The VPN server config is not easily changed.
Best Answer
I found a solution to my problem. I simply used OpenConnect instead of Cisco's own client.
OpenConnect (http://www.infradead.org/openconnect/) is an open source client for Cisco's AnyConnect SSL VPN,build around GnuTLS and OpenSSL. It runs on BSD, Linux, Mac and Windows.
For me it solved the problem on both Linux (Ubuntu 14, using the package network-manager-openconnect) and Windows (Win7 64bit, using http://www.infradead.org/openconnect/gui.html / https://github.com/openconnect/openconnect-gui/wiki).
Below are routes before and after VPN connection with OpenConnect. Contrast those to the AnyConnect case, where the 172.16.0.0 routes were removed.
I now enjoy access to the VPN resources, and my local LAN (in paticular my network attached sampling device on 172.16.97.2).
Routes before OpenConnect connection:
Routes after openconnect conneciton: