IPv6 addresses on LAN adapter causing AnyConnect VPN to reconnect

[dmills488]

I am seeing end users having their VPN connection disconnected and reconnected when IPv6 addresses change on the LAN network adapter. I've disabled IPv6 on the AnyConnect adapter, Microsoft won't provide support if IPv6 is disabled on the physical adapter, and I have no control over the end user's home network. 

Below are log examples showing additional IPv6 addresses added to Wi-Fi adapter, Ethernet 2 is the AnyConnect adatper.

2020- 12-17 09:16:17	2073	IP addresses from active interfaces: Ethernet 2: 10.x.x.1 Wi-Fi: 192.168.1.96, 2600:1700:x:x:x:x:x:44, FE80:x:x:x:x:x:x:FAA8
2020-12-17 09:21:51	2012	Reconfigure reason code 15: New network interface.
2020-12-17 09:21:51	2073	IP addresses from active interfaces: Ethernet 2: 10.x.x.1 Wi-Fi: 192.168.1.96, 2600:1700:x:x:x:x:x:44, 2600:1700:x:x:x:x:x:FAA8, 2600:1700:x:x:x:x:x:C51A, FE80:x:x:x:x:x:x:FAA8
2020-12-17 09:21:51	2070	A new network interface address has been detected.
2020-12-17 09:21:52	2040	The entire VPN connection has been reconfigured.

Between IPv6 privacy extensions and temporary addresses it seems that IPv6 is designed to function this way. Has anyone experienced these AnyConnect disconnects when IPv6 is used on the end user's network?

[marce1000]

   - Make sure , users are using the correct network adapter before connecting with AnyConnect (on the second line).

 M.

[dmills488]

The user is connected to the correct network adapter before connecting with AnyConnect.

Once connected with AnyConnect the user is not switching network adapters. 

The "new network interface" seems to be the new IPv6 addresses that are showing up on the same network adapter.

[dmills488]

We believe we're running into this bug: https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvv93458

It does seem like this impacts users who do have IPv6 privacy extensions feature disabled.

[prestonhuang]

Cisco team, are there any plans to implement a fix for this in a future AnyConnect client release, so that IPv6 privacy extensions can remain enabled?

[gajownik · Accepted solution]

CSCvv93458 is fixed in 4.10.01075 and later releases.

https://www.cisco.com/c/en/us/td/docs/security/vpn_client/anyconnect/anyconnect410/release/notes/release-notes-anyconnect-4-10.html#Cisco_Reference.dita_1cd6473c-a57b-4b36-8baa-1e28ad9d1607

[anthony pharo]

Gajownik, 

How would I view this bug in Wireshark?

[gajownik]

What do you mean exactly by "view this bug in Wireshark"?

1) 4.10.01075 was released 2 years ago and if you run anything newer you definitely did not hit this bug.
2) Wireshark is not the best tool to verify if you hit this specific bug.

Tunnel flap is triggered by assigning/removal of the temporary IPv6 address to the interface. You might not even see a packet sent using new IPv6 address in the collected capture.

3) Better approach would be collecting DART bundle and verifying Cisco AnyConnect Secure Mobility Client/AnyConnect.txt file.

[anthony pharo]

Thank you for your response gajownik,

What should I be looking for in the DART Bundle that would point to the IPV6 issue?

Thank you. 

Anthony

[anthony pharo]

We do not have a hardcoded IPv6 address on the ASA’s. That is part of the reason this testing is being done. We need to verify the code handles that response correct.  teams.microsoft.com responds with an IPv6 address, and it is the first response. If the end user is routing IPv6 and the response is IPv6 first, what happens? We know this issue exists; we ran into it within code 01075.  Thank U Gajownik

[gajownik]

You should check for the log messages posted in the initial message from this thread. If you run version 4.10.01075 then you definitely are not affected by bug CSCvv93458 and your problem is not related to issue discussed in this thread.

[TCAM]

Hi - gajownik

Can you confirm CSCvv93458 was also fixed in Cisco Secure client?  I am running v 5.1.1.42, i am still seeing the issue. VPN tunnel restarted when temporary IPv6 addresses was created or modified.

[adamparker]

I am experiencing this issue on AnyConnect version 4.10.05085. Is bug CSCvv93458 still affecting this version?

[Harold Ritter]

Hi @adamparker ,

This specific bug is fixed in the release you are currently running.

Regards,

[adamparker]

Thanks for verifying! I will open a ticket with support.