cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
910
Views
0
Helpful
3
Replies
Highlighted
VIP Advisor

AnyConnect 4.5.00058 and Linux, unable to transmit packets

Hi All

I just recently upgraded AnyConnect in my environment from a 4.3 release to the latest 4.5.00058. This client doesn't seem to work correctly under Linux though, I tested with Mint 18 and Ubuntu 16.04. It espablishes the connection successfully, but then stops at transmitting any data through the tunnel. I also tested a fresh AC installation and it will not work.

Any ideas?

3 REPLIES 3
Highlighted
Beginner

Hi,

starting with anyconnect 4.5, the clients drops outgoing packets by iptables

(testest on ubuntu 14.04 / 16.04 / 17.04 and OpenSuSE Leap 42.2 / 42.3)

 

With AnyConnect 4.4 and before, the iptables rules are

...

-A ciscovpn -i cscotun0 -j RETURN
-A ciscovpn -s <tunnelip>/32 -j RETURN
-A ciscovpn -j DROP

...

 

As of AnyConnect 4.5 (including 4.5.01044) there is a new rule dropping *ALL*

outgoing traffic via the tunnel:

...

-A ciscovpn -i cscotun0 -j RETURN
-A ciscovpn -s <tunnelip>/32 -j DROP
-A ciscovpn -s <tunnelip>/32 -j RETURN
-A ciscovpn -j DROP

...

 

Any ideas on how to prevent this? Or wether it has already been filed as bug?

 

Windows & Mac OS X work fine, though

 

Cheers,

Markus

Highlighted

New released Version 4.5.02033 seems to work now with ubuntu 16.10:

 

 

tail of output of iptables-save:

 

-A ciscovpn -i cscotun0 -j RETURN

-A ciscovpn -s <tunnelip> -s <localLANnet/mask> -o cscotun0 -j DROP

-A ciscovpn -s <tunnelip> -s <169.254.0.0/16> -o cscotun0 -j DROP

-A ciscovpn -s <tunnelip> -o cscotun0 -j RETURN

-A ciscovpn -j DROP

 

regards and greetings to Markus :-)

 

Markus

 

 

Highlighted

Hey,

 

I'm running 4.5.02036 on fedora 30 and have the following rules:

 

-A ciscovpn -i cscotun0 -j RETURN
-A ciscovpn -s <omitted> -o cscotun0 -j RETURN
-A ciscovpn -j DROP
-A ciscovpnfinal -j ACCEPT
COMMIT

 

However, no packets go through. Any ideas what might be going wrong?

Content for Community-Ad