GitHub/GitLab access with Cisco AnyConnect

[juanbh255]

Is there a way that I can set up Cisco AnyConnect to allow me to reach GitHub/GitLab sites while still connected to a DevNet sandbox? constantly disconnecting/reconnecting really does suck. I would like to be able to run a git pull/push while vpn'd into sandboxes.

[jokearns1]

Hi, 

Thats interesting. Sandbox VPN uses split tunnelling to only route specific traffic down to our subnets. You can see these in the route details section of the Anyconnect stats when VPN is active Can you tell me what your local IP is? 

Thanks, 

Support.

[dstaudt]

The sandbox labs should support split-tunnel, if you can configure that in your client.

[juanbh255]

How do I configure it?

[bigevilbeard]

@juanbh255 

1. Open Cisco AnyConnect on your device.
2. Click on the Gear icon in the Preferences.
3. In the Preferences window, navigate to VPN > Split Tunneling.
4. Look for the Split Tunneling option. If it's enabled, you should see a checkbox next to it. If the checkbox is selected, split tunneling is enabled.

Could you provide a ping/trace/nslookup to GitHub when connected on the VPN and output of your local route table, from the images you first shared this looks like it is enabled? I am wondering if this is a DNS issue, looks like you are using Windows and i am sure i sure this before and it was a case of setting local DNS up.

Hope this helps.

[juanbh255]

@bigevilbeard 

Split Tunneling looks to be enabled. 

$ nslookup registry-1.docker.io
Server: dns1.production.devnetsandbox.local
Address: 10.17.248.11

*** dns1.production.devnetsandbox.local can't find registry-1.docker.io: Query refused

Tracing route to registry-1.docker.io [34.226.69.105]
over a maximum of 30 hops:

1 <1 ms <1 ms <1 ms 192.168.1.1
2 2 ms 2 ms <1 ms lo0-100.NWRKNJ-VFTTP-332.verizon-gni.net [71.172.67.1]
3 3 ms 4 ms 3 ms 100.41.26.220
4 * * * Request timed out.
5 17 ms 9 ms 9 ms customer.alter.net [63.125.106.130]
6 * * * Request timed out.
7 * * * Request timed out.
8 * * * Request timed out.
9 * * * Request timed out.
10 * * * Request timed out.

$ ping registry-1.docker.io

Pinging registry-1.docker.io [34.226.69.105] with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.

Ping statistics for 34.226.69.105:
Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

[bigevilbeard]

@juanbh255 this looks like a dns issue, see this thread here https://community.cisco.com/t5/devnet-sandbox/internet-on-my-laptop-stops-when-on-vpn/m-p/4055662#M4568

The DNS server is using a private IP address (like the one you mentioned, 10.17.248.11), it won't be able to resolve external domain names like registry-1.docker.io and I believe is your issue. Follow the steps in the other thread re disable your local IPv6 connection. 

Hope this helps

[juanbh255]

I tried disabling IPv6 on my NIC but no change.

it looks like it is using dns of sandbox:

*** dns1.production.devnetsandbox.local can't find registry-1.docker.io: Query refused

[bigevilbeard · Accepted solution]

@juanbh255 try adding a public dns as your secondary address on your local machine 

[juanbh255 · Accepted solution]

@bigevilbeard Thanks that worked. 

[juanbh255]

@bigevilbeard Do you anyway to make this dns update persistent? Looks like I have to reconfig this everytime I connect to devnet sandbox vpn using Cisco Anyconnect and so that Network adapter settings change too.

[juanbh255]