Subject: [v6ops] OSX 10.8 failures with Cisco Anyconnect VPN client

From: Mark Boolootian <[email-masked]>
Date: Thu, 16 May 2013 16:24:55 -0700

I've got a Macbook running 10.8.3.  It has a v6 GUA, and a public v4
address.  Works dandy.

Now I bring up a VPN tunnel with Cisco Anyconnect Secure Mobility
Client (v3.1).  The VPN is IPv4 only.  If I point Safari or Chrome at
www.google.com, I get back nothing.  A little poking shows that DNS
AAAA queries are being issued.  As near as I can tell, that shouldn't
be happening, since the tunnel is v4 only.

Whose bug is this likely to be?  It looks to me like a problem with
the resolver library looking at the physical interface, instead of the
tunnel interface, for determining how to query DNS.  I haven't opened
a ticket with Cisco yet, but plan to.

Insight appreciated,
mark

---

From: Mark Andrews <[email-masked]>
Date: Fri, 17 May 2013 09:58:59 +1000

> be happening, since the tunnel is v4 only.

And unless the VPN client has disabled IPv6 on all interfaces you
still have a v6 GUA and theoretically global connectivity.  If the
VPN server is reached over IPv6 this is a bad idea to do.

> a ticket with Cisco yet, but plan to. 

It is the application's (browser) bug.  It should be failing over
fast.  Unfortunately Apple decided to be smart when simple is what
you need for happy eyeballs.

It may also be a VPN client bug if it adds more specific IPv6 routes
then black holes the traffic.  It a minimum it should be sending
ICMP unreachable if it add more specific IPv6 routes.

Mark

> Insight appreciated,
> mark
> _______________________________________________
> v6ops mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/v6ops
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]