Cisco VPN client connects, but restricts LAN access even when option is ENABLED...

[heweaver@gmail.com]

Our help desk (about 20 of us) connect to the corporate network from
our location via the CISCO SYSTEMS VPN CLIENT software version number
4.0.3(f).

We DO have ENABLE LAN ACCESS checked, because (being a help desk) we
need to access local printers, shared network resources, etc.

However, about 10 or 20 minutes after we connect via VPN client, it
will cut off our local LAN access. When this happens, if we click on
START we have to wait about 30 seconds for it to respond. If we click
on RUN, we have to wait another 30 seconds or so. Just about anything
we do is bugged by this horrible lagtime that makes us wait for 30
seconds at a time. When we start experiencing the lag, we can no longer
access each others computers, shared network drives, network printers,
NOTHING except the external internet and our intranet sites.

When we connect, and go to STATUS / STATISTICS, the box that displays
information about the current connection comes up, and under the
TRANSPORT section it says:

Transparant Tunneling: Active on TCP port 10001
Local LAN: DISABLED
Compression: NONE

Also, if we go to the ROUTE DETAILS, the entire lefthand side under
LOCAL LAN ROUTES is completely empty.


We have found, that if we open a windows explorer folder of one of our
network shares, and leave it opened (but minimized) then it isn't very
likely to drop our LAN access. However, if we close that window, its
usually within 30 minutes that our LAN access is dropped.

When we lose that access, we can disconnect our VPN client and
re-connect, but all of our web applications for the intranet and our
connection to our lotus notes mail server is terminated, so we have to
close them all out and re-open them... but this constantly logging on
or off is hardly an efficient use of our time.

Since we DO have the option enabled, but once connected the status
displays DISABLED, would this be some kind of a server group policy
being pushed down or something?

If so, what details would I need to provide our network administrators
to see what can be done to fix this. It's just terribly annoying and a
waste of our time. Any explanation or advice would be greatly
appreciated!

Thanks!

[gzb4zp]

We have a very similar problem though have version 4.8.01.03 of the Cisco Client, and are using IPSec over UDP. Do not have the same lag time issues, but not able to access the local LAN. We are also a support organization, and a 3rd party supplier hosts the VPN for our client. They have told us the VPN is setup to support split tunneling, however unable to access local LAN features. The Allow Local LAN Access is selected, but shows as Disabled in the VPN Statistics window. Possibly there is some IPSec setting that need to be enabled on the client, though on the surface it looks like this Local LAN option would work as described in the Cisco documentation. Was wondering if you were able to make any progress on your issue?

[opticalfiber]

PROBLEM:

Even if you have Allow Local LAN Access checked, your administrator can override the value and disable it on you.


WORKAROUND:

Assuming your local lan is 192.168.1.0/24 (has IP addresses between 192.168.1.1 and 192.168.1.254), and you have admin rights on your machine, you can modify the routing table!

You need to do this EVERY TIME YOU CONNECT, as the Cisco client will inject the routes upon each connection.

This simply deletes the "override" by removing the route map between your local LAN range and the VPN Interface.

1. Connect to your Cisco VPN server
2. Go to Status > Statistics > Tunnel Details and Verify that Local LAN Access is "Disabled" under the Transport heading. If it shows Enabled, then you have another issue preventing your access which can't be solved here)

3. OPEN A COMMAND PROMPT AND TYPE "route delete 192.168.1.0" (without quotes, where 192.168.1.0 is your local LAN)

4. Try to ping or connect to a local machine to verify success.

Enjoy!

[yambu]

I realize this topic is for Cisco VPN, but I am having an identical problem with Aventail client. I use Aventail Connect 5.34. My IT department has configured the client with retricted local network access, defined as follows:

Restricted: Refuse non-directed connections (no local access) Connections to remote resources are redirected to the remote network; all other connections are refused.

This prevents me from printing to the printer on my LAN etc. without disconnecting from the remote network first. I tried the suggestion above, and entered the following command in a command window:

>route delete 192.168.1.0

This gives me the following error msg:
The route specified was not found.

a ROUTE PRINT command yields the following:

Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.1.1 192.168.1.8 25
127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
169.254.0.0 255.255.0.0 192.168.1.8 192.168.1.8 30
192.168.1.0 255.255.255.0 192.168.1.8 192.168.1.8 25
192.168.1.8 255.255.255.255 127.0.0.1 127.0.0.1 25
192.168.1.255 255.255.255.255 192.168.1.8 192.168.1.8 25
224.0.0.0 240.0.0.0 192.168.1.8 192.168.1.8 25
255.255.255.255 255.255.255.255 192.168.1.8 2 1
255.255.255.255 255.255.255.255 192.168.1.8 192.168.1.8 1
Default Gateway: 192.168.1.1
===========================================================================
Persistent Routes:
None

Does the solution for the CISCO also apply to my VPN client? If so, any clues as to what I'm doing wrong?

Thanks!

[zabzoo]

PROBLEM:

Even if you have Allow Local LAN Access checked, your administrator can override the value and disable it on you.


WORKAROUND:

Assuming your local lan is 192.168.1.0/24 (has IP addresses between 192.168.1.1 and 192.168.1.254), and you have admin rights on your machine, you can modify the routing table!

You need to do this EVERY TIME YOU CONNECT, as the Cisco client will inject the routes upon each connection.

...

3. OPEN A COMMAND PROMPT AND TYPE "route delete 192.168.1.0" (without quotes, where 192.168.1.0 is your local LAN)

4. Try to ping or connect to a local machine to verify success.

Enjoy!

I have Cisco VPN Client 5.0.00.0340; i have tried your advice without success; only difference is my local network is 10.0.1.#

route delete 10.0.1.1

However, these two entries remain -
route print ... >
10.0.1.0 , , , 255.255.255.0 , , , 10.0.1.6 , , , 10.0.1.6 , , , 25
10.0.1.0 , , , 255.255.255.0 , , , 10.0.1.14 , , , 10.0.1.14 , , , 20

Can you assist me to troubleshoot?