ā03-26-2021 08:27 PM - edited ā03-26-2021 08:34 PM
Hi Everyone,
We (my office) are planning to use ANYCONNECT VPN via Nord/SurfShark VPNs for some of our Customers. And I was testing it connectivity and I came across an issue.
My issue:
I am able to connect to the ANYCONNECT VPN while I am connected to Nord/SurfShark VPNs. But, when I try accessing my servers using DNS names, they are not working. The access works via IP addresses.
With out the Nord/SurfShark, DNS resolution works well, but with Nord/SurfShark, the DNS Server information obtained via the ANYCONNECT VPN is not being preferred. NordVPN DNS is taking preference.
My network setup: External User --> INTERNET ---> Cisco ASR ---> Fortigate Firewall ---> Cisco ASA (VPN Server with Public IP)
LAN is connected to Fortigate firewall's other interface.
I spoke to the CustomerService support team of Surfshark and all they kept saying was - you cannot run a VPN on another VPN and when I explained the DNS/IP problem, they didnt have a solid answer for me.
I wanted to see if you anyone of you faced this issue and have any work arounds for this issue or I wanted to know I there are any configuration settings I need to change on the ANYCONNECT end.
Thank you all in advance.
ā03-27-2021 03:07 AM
I am not familiar with Surfshark vpn and have looked at their web site and have found a couple of things that might relate to your issue. I did find a statement about their use of DNS "With private DNS on each server and leak protection when using IPv4 stack, we take our security to the next level." It does sound like they control DNS requests and it would be logical that they would not allow DNS resolution that was not through them.
I found a reference to a feature called Whitelister which says "Allow specific apps & websites to bypass the VPN. Works great with mobile banking apps." I wonder if there is a way to use this feature to exempt AnyConnect traffic from their controls. In another part of their web site it says "Does your banking website not work with a VPN? Perhaps youāre having issues with Outlook or some other app? Simply add them to the split tunneling and theyāll use the internet as if you didnāt have a VPN at all. At the same time, apps and websites not on Whitelister will benefit from the usual levels of VPN protection." I wonder if Whitelister would be a way to exempt AnyConnect from their control.
I would agree that using a vpn within a vpn is very unusual. I am not sure that I would go as far as "you cannot run a VPN on another VPN". I wonder if there is something in their implementation that makes this be the case? And the fact that AnyConnect seems to work if access is via IP rather than by name would seem to suggest that you can indeed run a vpn on another vpn.
ā03-27-2021 07:32 PM
As I have thought about this issue I have a couple more thoughts about it.
- with AnyConnect you can choose when to run it (and when to run without it). I am not clear whether Surfshark has a similar ability to select when to run with its vpn. I get the impression that Surfshark may run all the time. Do you have any information about this?
- I believe that split tunnel is the likely solution for your issue, if you can get it to work the way that I will describe. The concept of split tunnel is that you can configure a vpn so that certain traffic is carried over the vpn and other traffic is not carried over the vpn. From what I read it sounds like Surfshark implements split tunnel in the feature that they call Whitelister. If you can identify the resources that you want to access using AnyConnect and then in Surfshark configure those resources to not be carried in that vpn then it might allow that traffic to be carried by AnyConnect.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide