topic Re: GitHub/GitLab access with Cisco AnyConnect in DevNet Sandbox

GitHub/GitLab access with Cisco AnyConnect

juanbh255 — Mon, 08 Jul 2024 20:05:32 GMT

Is there a way that I can set up Cisco AnyConnect to allow me to reach GitHub/GitLab sites while still connected to a DevNet sandbox? constantly disconnecting/reconnecting really does suck. I would like to be able to run a git pull/push while vpn'd into sandboxes.

Re: GitHub/GitLab access with Cisco AnyConnect

jokearns1 — Mon, 08 Jul 2024 21:09:10 GMT

Hi,

Thats interesting. Sandbox VPN uses split tunnelling to only route specific traffic down to our subnets. You can see these in the route details section of the Anyconnect stats when VPN is active Can you tell me what your local IP is?

Thanks,

Support.

Re: GitHub/GitLab access with Cisco AnyConnect

dstaudt — Mon, 08 Jul 2024 21:27:18 GMT

The sandbox labs should support split-tunnel, if you can configure that in your client.

Re: GitHub/GitLab access with Cisco AnyConnect

juanbh255 — Mon, 08 Jul 2024 21:38:16 GMT

Re: GitHub/GitLab access with Cisco AnyConnect

juanbh255 — Wed, 17 Jul 2024 10:24:57 GMT

How do I configure it?

Re: GitHub/GitLab access with Cisco AnyConnect

bigevilbeard — Wed, 17 Jul 2024 10:34:59 GMT

@juanbh255

Open Cisco AnyConnect on your device.
Click on the Gear icon in the Preferences.
In the Preferences window, navigate to VPN > Split Tunneling.
Look for the Split Tunneling option. If it's enabled, you should see a checkbox next to it. If the checkbox is selected, split tunneling is enabled.

Could you provide a ping/trace/nslookup to GitHub when connected on the VPN and output of your local route table, from the images you first shared this looks like it is enabled? I am wondering if this is a DNS issue, looks like you are using Windows and i am sure i sure this before and it was a case of setting local DNS up.

Hope this helps.

Re: GitHub/GitLab access with Cisco AnyConnect

juanbh255 — Sun, 21 Jul 2024 11:05:07 GMT

@bigevilbeard

Split Tunneling looks to be enabled.

$ nslookup registry-1.docker.io
Server: dns1.production.devnetsandbox.local
Address: 10.17.248.11

*** dns1.production.devnetsandbox.local can't find registry-1.docker.io: Query refused

Tracing route to registry-1.docker.io [34.226.69.105]
over a maximum of 30 hops:

1 <1 ms <1 ms <1 ms 192.168.1.1
2 2 ms 2 ms <1 ms lo0-100.NWRKNJ-VFTTP-332.verizon-gni.net [71.172.67.1]
3 3 ms 4 ms 3 ms 100.41.26.220
4 * * * Request timed out.
5 17 ms 9 ms 9 ms customer.alter.net [63.125.106.130]
6 * * * Request timed out.
7 * * * Request timed out.
8 * * * Request timed out.
9 * * * Request timed out.
10 * * * Request timed out.

$ ping registry-1.docker.io

Pinging registry-1.docker.io [34.226.69.105] with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.

Ping statistics for 34.226.69.105:
Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

Re: GitHub/GitLab access with Cisco AnyConnect

bigevilbeard — Sun, 21 Jul 2024 13:28:09 GMT

@juanbh255 this looks like a dns issue, see this thread here https://community.cisco.com/t5/devnet-sandbox/internet-on-my-laptop-stops-when-on-vpn/m-p/4055662#M4568

The DNS server is using a private IP address (like the one you mentioned, 10.17.248.11), it won't be able to resolve external domain names like registry-1.docker.io and I believe is your issue. Follow the steps in the other thread re disable your local IPv6 connection.

Hope this helps

Re: GitHub/GitLab access with Cisco AnyConnect

juanbh255 — Mon, 22 Jul 2024 10:50:36 GMT

I tried disabling IPv6 on my NIC but no change.

it looks like it is using dns of sandbox:

*** dns1.production.devnetsandbox.local can't find registry-1.docker.io: Query refused

Re: GitHub/GitLab access with Cisco AnyConnect

bigevilbeard — Mon, 22 Jul 2024 12:53:02 GMT

@juanbh255 try adding a public dns as your secondary address on your local machine

Re: GitHub/GitLab access with Cisco AnyConnect

juanbh255 — Tue, 23 Jul 2024 18:39:29 GMT

@bigevilbeard Thanks that worked.

Re: GitHub/GitLab access with Cisco AnyConnect

juanbh255 — Thu, 25 Jul 2024 12:43:11 GMT

@bigevilbeard Do you anyway to make this dns update persistent? Looks like I have to reconfig this everytime I connect to devnet sandbox vpn using Cisco Anyconnect and so that Network adapter settings change too.