SSL VPN - Unable to modify IP forwarding table

[cdaero2]

Some of our clients cannot connect from home over SSL/VPN. The IPSec clients work for them but the SSL clients give the "cannot modify IP forwarding table error".

Other clients do not have this problem. We've noticed that Linksys and Netgear clients have some problems where as Apple Airport clients do not. I know there is an open caveat for Linksys but there is no explanation on Cisco's site for the real cause of this problem is.

Can anyone clarify?

[umedryk]

You need to check for the caveats of Linksys boxes...

[cdaero2]

As I stated in the original post I know of the open caveat for Linksys. However more than just Linksys routers are giving this error and there is no explanation of the error just a "we've notified Linksys of the problem" message. Isn't there any more information on what is going on here?

[irafalovsky]

We have experienced the same problem, except it doesn't seem to be only related to an adapter type. Our office LAN is segmented from 10.0.0.0 space and for some users (IntelPRO wireless embedded adapter, for example), SSL VPN client would only work if the computer has 10.0.0.0 (regardless of subnetting). If their home LAN is, say a subnet of 192.168.0.0, the client will generate the same "cannot modify IP routing table" error.

CISCO folks, is there a fix for this, definitely seems like a software bug in SSL VPN client code...

[john.gudmann]

I had the same problem :-)

After I remove the ip address range of my local lan.

eks 192.168.1.0 /24 from the network list. It work fine again. I'm using "spilt tunnel" and my concolusen is that the SSL client don't use the "use local lan" If you take at look of the status it's saying: loacl lan : Disabled But it work anyway

[irafalovsky]

We have local LANs disabled in the CVPN and the only time this problem occurs is when the client's mashine's IP address is on the different IP address range from the office LAN and only for some clients. Still seems like a SSL VPN client bug to me, perhaps CISCO development folks can address this...

[cdaero2]

its been a while and no input from Cisco directly...hello..is this microphone on? Need SSL VPN to work on 192.168 home networks!

[irafalovsky]

Could someone please open a TAC ticket for this issue? I just switched jobs and in the process of signing a support contract, so can't do it myself...