topic Re: Anyconnect ISE posture IPv6 infinite loop (CSCvo36890) in Network Access Control

Anyconnect ISE posture IPv6 infinite loop (CSCvo36890)

Panos Bouras — Wed, 20 May 2020 09:32:01 GMT

Hi all,

During a posture deployment on Windows 10 with ISE2.4 and AC 4.7 & 4.8 we hit the following bug

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvo36890/?rfs=iqvred

If we perform the Teredo disable command it gets enabled again after restart and I'm not sure what we will break if we disable it via GPO etc.

As the Bug report doesn't actually provides much details,I'm looking for possible mitigations and workarounds.

Anybody has any experience with this issue and successful resolutions?

Re: Anyconnect ISE posture IPv6 infinite loop (CSCvo36890)

paul — Wed, 20 May 2020 22:43:26 GMT

A customer of mine ran into this. They had to push a registry setting via GPO policy to disable the teredo adapter. Once they did that their posturing issues (i.e. constant pop-ups and reposturing) went away.

Re: Anyconnect ISE posture IPv6 infinite loop (CSCvo36890)

Panos Bouras — Tue, 09 Jun 2020 13:42:13 GMT

Thank you Paul.

Re: Anyconnect ISE posture IPv6 infinite loop (CSCvo36890)

Mohamed Abdi — Tue, 09 Jun 2020 14:56:59 GMT

We ran into similar issues. Some users also reported no policy server detected, no internet and no outlooks accessible. Disabled IPV6 on client machine resolved the issue. We opened a ticket with TAC, and they recommend we should apply this command "client-bypass-protocol enable" under the group-policy. I haven't tested the command yet.

Re: Anyconnect ISE posture IPv6 infinite loop (CSCvo36890)

Panos Bouras — Mon, 22 Jun 2020 13:24:15 GMT

Hi Mohamed,

I believe that "client-bypass-protocol enable" applies to firewalls or at least VPN configuration. We witnessed this behavior at switch connected devices, but not during our VPN tests where the same client was terminating VPN connection to FTD 2100 6.4.0 firewalls using 4.7 Anyconnect. ISE and AD infrastructure was the same.