Anyconnect ISE posture IPv6 infinite loop (CSCvo36890)

[Panos Bouras]

Hi all,

During a posture deployment on Windows 10 with ISE2.4 and AC 4.7 & 4.8 we hit the following bug

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvo36890/?rfs=iqvred

If we perform the Teredo disable command it gets enabled again after restart and I'm not sure what we will break if we disable it via GPO etc.

As the Bug report doesn't actually provides much details,I'm looking for possible mitigations and workarounds.

Anybody has any experience with this issue and successful resolutions?

[paul · Accepted solution]

A customer of mine ran into this.  They had to push a registry setting via GPO policy to disable the teredo adapter.  Once they did that their posturing issues (i.e. constant pop-ups and reposturing) went away.

[Panos Bouras]

Thank you Paul.

[Mohamed Abdi]

We ran into similar issues. Some users also reported no policy server detected, no internet and no outlooks accessible. Disabled IPV6 on client machine resolved the issue. We opened a ticket with TAC, and they recommend we should apply this command "client-bypass-protocol enable" under the group-policy. I haven't tested the command yet.

[Panos Bouras]

Hi Mohamed,

I believe that "client-bypass-protocol enable" applies to firewalls or at least VPN configuration. We witnessed this behavior at switch connected devices, but not during our VPN tests where the same client was terminating VPN connection to FTD 2100 6.4.0 firewalls using 4.7 Anyconnect. ISE and AD infrastructure was the same.