Cisco - AnyConnect VPN - Cannot Map Drives HELP!

[mbucholz]

We were given instructions to use on our personal computers and I cannot map a drive. IT doesn't know how to help me. It seems like I'm the only person it doesn't work for. It says, "Windows cannot access [the drive]. Check the spelling of the name. Otherwise, there may be a problem with your network." My IP is a private IPv4 connection. I'm about as savvy with this stuff as...if you tell me step by step how to do something I can follow it. I'm not real great at diagnosing what's wrong and half the forums I've read I don't understand a thing they are talking about. Help?

[Cristian Matei]

Hi,

   I assume you're trying to map drives when the VPN session is established, right? What is your VPN headend, and can you provide the config?

          - if you're mapping drives based on FQDN, and not IP, ensure that you can properly resolve that name through the assigned DNS servers 

          - ensure , in case you use split-split-tunneling , that traffic towards those resources is allowed to go through the tunnel

          - if you have NAT configured on the VPN gateway, ensure the VPN traffic is bidirectionally excluded from NAT

If you provide the used config, some other things may pop up.

Regards,

Cristian Matei.

[mbucholz]

I don't understand most of what you said, but here's their configuration. As for the VPN, we click the Cisco any connect and they give us the name of the VPN, no IP. And we hit connect. That's all I know about VPN. I know of the term NAT, but I have no idea how I would check that or how it relates to VPN. So basically I know next to nothing about that either. I'm connected via ethernet. I have no idea what split-split tunneling means. I don't know what resolving through DNS servers means. Not sure if any of this helps.

1. Click on your computer start menu and type This PC
2. 1st drive is your H: drive
   1. On the top of the of window you will see Map Network Drive, click to open.
   2. Drive: select H:
   3. Copy and paste   \\corefs.med.umich.edu\uniquename but replace uniquename with your unique name
   4. Regarding the Reconnect at login box: If the machine is not always on the UMHS network, or you are unsure, do not place a check in the box.
   5. Click the Finish button.
   6. If prompted for a user name and password, use the following settings: User Name: UMHS\uniqname Password: level two password.
      1.           Troubleshooting: If it “hangs” at Attempting to connect to \\corefs.med.umich.edu\uniquename…”,
         1. hit “Cancel”
         2. Disconnect from and reconnect to the VPN
         3. Check “Connect using different credentials” and try again
         4. It should prompt for username and password, which should be entered as shown above.
      2. New window will open with your H: drive. Close the window.

[Marvin Rhoads]

When your VPN connection is active, open a Windows command prompt and type:

     nslookup corefs.med.umich.edu

If you don't get an IP address back, then your client's DNS is not getting changed the way it should be by the AnyConnect client software.

[mbucholz]

Hi Marvin,

Thanks for explaining the steps. So it comes back as

Server:  UnKnown
Address:  141.XXX.X.XX   (the X's are numbers)

*** UnKnown can't find corefs.med.umich.edu: Non-existent domain

[Marvin Rhoads]

It appears the VPN administrator hasn't properly configured the DNS server value in the group policy. Until they do, you won't be able to convert the server's name to an IP address on the remote network.

There are a couple of workarounds. The easiest one is to ascertain the server's IP address. For instance, ask somebody who is on the main network to do the nslookup for you. Then you can substitute that IP address in place of the name "corefs.med.umich.edu" when you map a drive. The other is to ascertain the remote network DNS server address and use it on your nslookup process. If you can get that address then just type from a command prompt:

nslookup

server <insert DNS server address here>

corefs.med.umich.edu

You should get the corefs server IP address returned from entering that last line above. You will have to enter those commands while connected to the VPN. Otherwise your PC won't be able to reach the remote internal DNS server.

[mbucholz]

Ok how do I explain from one person who is not savvy to another person who is not savvy how to look up these suggestions? 

Not sure if any of these things help that I can see:

If I look under the Cisco VPN setting gear thing, I get this

Client (IPv4): 10.XXX.XX.XXX (there's numbers there)

Client (IPv6): Not Available

Server: 192.XX.XX.XXX 

If I go to my Network and click network properties for my connection I have:

IPv4 address: 10.XXX.XX.XXX/19

DNS Servers: 141.XXX.X.XX, 141.XXX.X.XX

DNS connection suffix: adsroot.itcs.umich.edu

Are any of these things useful?

[Cristian Matei]

Hi,

   On a Windows box, after the VPN session is established, open a terminal, issue "ipfconfig /all", and see if you have a DNS server assigned to your VPN interface; if not, you need to tell your VPN administrator to assign at least one DNS server to the VPN policy, which can resolve the internal FQDN's you're looking for. Once this is fixed, establish the VPN connection and try to "ping xyz.test.com", your FQDN you need to map, and see if it gets resolved into an IP address; if your VPN config is good and the destination answers to ICMP Echo Requests, you should also get a ICMP Echo Reply, so at this point mapping should work.

    Fix the DNS assignment for the VPN tunnel, and afterwards, if you have split-tunnelling configured, the DNS resolution may still not work, due to possible split DNS issues. But let's get there first.

Regards,

Cristian Matei.

[mbucholz]

I get the following from ipconfig/all - Assume all X's are numbers. I didn't understand the rest. I pinged xyz.test.com (was that literally what I was supposed to put in?) and it gave me an IP address. It said 100% package loss. Sorry, what might be step by step for you might still be beyond me.

Windows IP Configuration

   Host Name . . . . . . . . . . . . : DESKTOP-7R8P9T2
   Primary Dns Suffix  . . . . . . . :
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No
   DNS Suffix Search List. . . . . . : adsroot.itcs.umich.edu

Ethernet adapter Ethernet 4:

   Connection-specific DNS Suffix  . : adsroot.itcs.umich.edu
   Description . . . . . . . . . . . : Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows x64
   Physical Address. . . . . . . . . : 00-05-9A-3C-7A-XX
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : [letters/numbers/% here] (Preferred)
   Link-local IPv6 Address . . . . . : [letters/numbers/% here] (Preferred)
   IPv4 Address. . . . . . . . . . . : 10.XXX.XX.XXX(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.224.0
   Default Gateway . . . . . . . . . : ::
   DHCPv6 IAID . . . . . . . . . . . : 8556394XX
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-24-3B-16-56-20-16-B9-0D-0B-XX
   DNS Servers . . . . . . . . . . . : 141.XX.X.36
                                       141.XXX.X.37
   NetBIOS over Tcpip. . . . . . . . : Enabled

[Cristian Matei]

Hi,

    I see you have DNS servers attached to your VPN vNIC: 141.XX.X.36, and 141.XX.X.37. Ty to ping not xyz.com, but whatever is the FQDN of the resource you're trying to make mapping for, like "ping myfileserver.adsroot.itcs.umich.edu", replace the "myfileserver" and "adsroot.itcs.umich.edu" with the proper name and domain-name of the resource you're trying to map. Does it work?

Regards,

Cristian Matei.

[mbucholz]

Sorry I still don't understand. How do I know what the domain name is?

The only thing that we were given for the mapping is this. Is  corefs.med.umich.edu the doman name you're referring to? or adsroot.itcs.umich.edu? I don't know what else would go in "myfileserver"

1. On the top of the of window you will see Map Network Drive, click to open.
2. Drive: select H:
3. Copy and paste   \\corefs.med.umich.edu\uniquename but replace uniquename with your unique name
4. Regarding the Reconnect at login box: If the machine is not always on the UMHS network, or you are unsure, do not place a check in the box.
5. Click the Finish button.
6. If prompted for a user name and password, use the following settings: User Name: UMHS\uniqname Password: level two password.

[mbucholz]

I tried putting different things after ping idk if it makes any difference. Nothing happened when I pinged corefs.med.umich.edu

When I pinged adsroot.itcs.umich.edu I got a IP address and 0% packet loss. I tried both the IP  address  for the mapping \\{IP Address}\uniquename and that did not work. I tried \\adsroot.itcs.umich.edu\uniquename and that didn't work either. Not sure if I was doing that right

[Cristian Matei]

Hi,

  Ping "corefs.med.umich.edu" and see if at least it gets resolved; if not, escalate the problem to confirm the DNS servers you get from VPN can resolve that.

Regards,

Cristian Matei.

[mbucholz]

Hello,

Nope. It said non-existent domain. Supposedly I'm the only person having an issue with this following the same instructions as everyone else in my department that went home. I don't know. I've forwarded this thread to one of our IT people. Hopefully they'll be able to help further with the information you guys have given.

I appreciate all your help! Sorry that I couldn't give lots of great information. I'm sure it would have been much easier if I knew what I was talking about. But thank you for all your patience.

[mbucholz]

We got it figured out after going over with IT and they remoted in. I got referred to someone that fixed another employee's issue. Thanks everyone!