OSX 10.11.3 Cannot VPN via AnyConnect 3.1.14018 via Verizon iPhone6 Hotspot to ASA 5550

[cisco]

I've done a fair amount of searching on this, have found similar issues but not this exact one.

I have a Mac running OSX 10.11.3 using Cisco AnyConnect 3.1.14018.  It can VPN to our ASA sw version 8.2(5)55 perfectly fine over any Wifi or LAN.  It cannot complete a VPN connection using a Verizon iPhone 6 running the latest iOS via the mobile hotspot.  The VPN connection itself requires both a certificate and a username/password (from AD authentication).

When the attempt is made, on the Mac we get the error: The VPN client was unable to successfully verify the IP forwarding table modifications. A VPN connection will not be established.

The connection can be made over other hotspots, Android over Verizon, IOS over AT&T, no problem.  IOS over Verizon?  Nope.  No luck with Verizon support either.

The only thing that stands out in the firewall log when the connection attempt fails is: Group <VPNPolicy> User <spongebob> IP <123.45.123.234> Transmitting large packet 1456 (threshold 1399).

Any ideas?

Thanks!

[Dina Odeh]

Hi, 

Seems that you are hitting this bug:

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCur55392/?reffering_site=dumpcr

Please apply the workaround and let us know if it will help 

[cisco]

According to the conditions of that bug, this problem doesn't fit.  The Mac isn't running Yosemite, and the tether works on every device I try except for a Verizon iPhone 6.  I'll take a look at the workaround, but I don't think it's going to make a difference since it's entirely different conditions.

[cisco]

ASA Running IOS 8.2(5)55, client-bypass-protocol isn't available via cli or asdm.

[Dina Odeh · Accepted solution]

Try please to turn off IPv.6 from the MAC interface 

[cisco]

Ok, it connects now.  The new problem is that there's no network throughput - user can't hit external websites or our internal email server.  I'll see if I can figure that out.  Thanks!

[coolbreeze]

I had this problem with an AT&T Hotspot connection.  Changed the WiFi IPv6 to Link-Local Only.  VPN client now connects.

[Rodrigo-1100]

it doesn't work in my case. macOS version 10.15.6 (19G2021)

[Rodrigo-1100]

>> error: The VPN client was unable to successfully verify the IP forwarding table modifications. A VPN connection will not be established.
>> state: Disconnected