Ok here's a strange one I'd like assistance on if you've seen this...
We use the dynamic exclusion split tunnel custom attribute so that users, once connected to AnyConnect SSL VPN, can get to a handful of websites using their own internet like Zoom and Youtube and not go over our tunnel. We've run into an issue where a Mac Catalina user can't access anything outside the tunnel. i.e. Pages in the exclusion list won't load when he's on this VPN getting the split tunnel custom attribute.
We uses a wireless router and we have yet to test whether or not this still happens when directly wired, but things we've tried:
-Enabling client protocol bypass on his group policy
-Checking if he can DNS resolve these sites, ping them, traceroute them, and load them via IP address (he can resolve and trace to these sites, loading them in browsers don't work, but pinging them returns a weird error 'Communication Prohibited by Filter')
-We've sent numerous DARTS to TAC and the only issue we agree on seeing is that the vpn adapter seems to be attempting to install local routes outside the tunnel that have already been installed upon connection
-We noticed the subnet user gets put on is 192.168.4.x which isn't unheard of, but seems specific to Eero. I'd expect 192.168.1.x to be typical, but either way the router/IPS would nat this
Anyone else come across issues accessing sites outside the VPN tunnel? This happens on all versions of AnyConnect 4.6, 4.7, and 4.9 we've tried.
I've seen another similar post here but the solution was to use client bypass protocol which didn't work for me. We have hundreds of other Mac users not having this problem on AC versions all the way up to 4.9 so I'm out of ideas.
