wsl 2 ubuntu 18.04 unable to connect to IP resources with Cisco Annyconnect active #4277
Comments
|
Not 100% sure, but it can be that annyconnecy blocks any dns server except provided by connection. I was observed something similar and was unable to disable this behaviour. |
|
I've tried the method of creating a manual named.conf and it didn't fix anything. I can ping the 1st dns server from windows but not from ubuntu.
Ubuntu
It seems to be more of a routing problem than a name resolution. For instance I can ping www.microsoft.com from a cmd prompt but not from ubunutu. windows
Ubuntu
|
|
Having exactly same problem...Errrrr |
|
I have the same issue, that from within the WSL 2 shell, I'm unable to use AnyConnect running in Windows. However, in WSL I installed openconnect, and I run: Also, this only works if I disconnect the VPN in Windows first, which is annoying. |
|
Same issue here. I tried to add search list in /etc/resolv.conf followed the guide here but still failed. |
|
If you're still experiencing this issue could you please take some networking logs? It will help us diagnose what's going on. You can find instructions on how to do so here! |
|
I'm definitely experiencing this issue and I'm running 18970. I can capture logs if needed. The problem is easy to reproduce. |
|
Well, cancel that. I don't have the Feedback Hub installed and I have another issue where I can't download app from the Microsoft Store because of some weird Microsoft Account issue that I'm working with support on. |
|
Also, if WSL 2 starts first, Cisco AnyConnect will fail to connect. |
|
I filed a feedback in FH. https://aka.ms/AA60j0u |
|
Same issue, I filed feedback using Feedback Hub. |
|
I also have the same issue with AnyConnect, also gave feedback in the Hub (although the option to post a recording was grayed out for me). |
|
I'm also having this problem and opened an issue for it in Feedback Hub with logs: https://aka.ms/AA6fthe |
I tried this route, but our AnyConnect uses 2FA which makes using openconnect impossible |
|
I'm in the same boat. WSL 2 is a godsend while I'm in the office; it's so much faster and better integrated than using a VirtualBox (or similar) VM. Unfortunately I still have to use said VM when connecting remotely via VPN because, as others here have described, all network connectivity from WSL 2 stops the moment the VPN is up. I use Cisco AnyConnect too although I imagine the problem is common to most VPN clients. Like @haselton I'm unable to use OpenConnect as the company I work for enforces 2FA. @craigloewen-msft - I'd dearly love to send you some logs but our workstation diagnostic data settings are locked down by Group Policy. If there's anything else I can do to help please let me know. WSL 2 is fabulous. |
|
@raisin-loaf thank you for the offer! I'll let you know if you can help out in any other way. We are investigating issues related to the VPN. |
|
I was able to resolve this by installing anyconnect pwa from the windows store the vpn connection now works with WSL when my stand alone installation of anyconnect 4.6 does not work... hope this helps someone |
It works! Thanks so much for posting this. |
|
I was having the same issue; i found that Anyconnect was setup to do full-tunnel, and therefore a route existed to throw all traffic through the VPN connection (likely including packets destined for the WSL2 vm). WSL2 routes are configured with a metric of 5256, and anyconnect routes have a metric of 2, and therefore take priority. I amended the routes for anyconnect (where metric == 2) to be 5257 instead, which seems to largely work. I used "NetRouteView" run as Admin to do the changes because I was too lazy to find the powershell equivilent commands :) This restored connectivity, but I found DNS to still be broken with the WSL default resolvconf ( |
|
Any movement on a fix for this? In my attempt to move away from macOS to Windows for dev, this has effectively stopped me completely as the company I work for uses AnyConnect. |
|
Yes we are tracking this and are looking into solutions with the networking team! I'll post any updates here as soon as they become available. |
|
Thanks a lot, this would be a life saver! |
|
For what it's worth I was having all the same issues described here. I saw AdonisLL post and tried it. I installed the AnyConnect UWP version available on the Windows store. Now, it seems to work perfectly! No jacking around with resolv.conf, or turning off generateResolvCon in wsl.conf. In fact the VPN seems much faster than the AnyConnect client 4.5 version I was using. Considering all the grief this was causing, this turned out to be a fast and easy fix for this! |
|
@kzeitz Company I work for requires 2FA authentication which it seems the Windows store version of AnyConnect doesn’t support. |
|
Ah, bummer. It's been so nice for this to just work likes its suppose to.
Sorry.
…On Sat, Jan 18, 2020 at 7:30 PM Chris Jones ***@***.***> wrote:
@kzeitz <https://github.com/kzeitz> Company I work for requires 2FA
authentication which it seems the Windows store version of AnyConnect
doesn’t support.
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
<#4277?email_source=notifications&email_token=ABCZVFI75HZHHGA3U3ZUCGTQ6O3NDA5CNFSM4H6UGPDKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEJKHCZQ#issuecomment-575959398>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/ABCZVFM32JGHKGJP45AKXPTQ6O3NDANCNFSM4H6UGPDA>
.
|
|
no one is assigned after all these struggles and time wasted. |
It's only been 2 years, I'm sure Microsoft is working on it. It's not like we pay for the produ.... oh, wait.. |
|
It (workaround) did not work for me either. |
|
Try this workaround: |
|
That's nice, consolidated information, which still requires ADMINISTRATOR privileges. |
|
@c3101 Is that comment about my workaround? |
|
Says right there in the linked Gist:
|
|
Oh right... I forgot that part.
Pinging doesn't work with some AnyConnect settings. However, tcp (HTTP, ssh, etc... Using wget, for example) should work |
|
@c3101 Maybe this could work for you https://github.com/sakai135/wsl-vpnkit |
This also works for me, good workaround! |
same here, but what fixed it finally for me is using the anyconnect app from the ms store and then go to windows vpn settings and use the config like so: |
|
I partially fixed by using Anyconnect version 4.10. |
|
Has anyone been able to test the new "BypassVirtualSubnetsOnlyV4"/"BypassVirtualSubnetsOnlyV6" with Cisco AnyConnect 4.10? Did it fix the problem? |
|
Well, nothing else was working for me so I worked around this by converting WSL Ubuntu-18.04 to and from wsl2 a couple of times that eventually seems to fix everything for me at least. Though I'm not sure about the real cause and not advocating this as a permanent solution. However, this seems to have worked for me and I can do coding within Windows again. |
It's work for me. Thank you you saved my time. |
Thank you. I had to bang the rocks together for a while before I found this answer. I knew about the interface metric reset and setting the internal nameserver in resolv.conf, but somehow the order of execution had eluded me, probably because I'd done it randomly the first few times by chance. I have additional issues in that my employer's implementation of the routing tables for AnyConnect is exceedingly strict, and includes all the IPv4 non-routable masks commonly used by the entire world for their home networks. (As frustrating as it is, they use them all, as we're a worldwide company with lots of internal networks. IPv6 plz.) I use RDP to connect to my work laptop in order to use my multi-monitor setup and custom ergonomic equipment, and after switching to a new work computer, there was a week of panic as I was having extreme difficulty connecting to the new machine. I would RDP in, establish the connection, and shortly thereafter, I'd get booted and the local UI would freeze up and require a hard power-down to re-establish access to the system. The prospect of having to program on a laptop keyboard was giving me RSI just thinking about it. Should anyone else encounter something like this, I determined that I had to establish the VPN connection using the local UI, then establish the RDP connection, and everything would work fine. Adding WSL 2 to the mix, I have to log into the local UI using cached domain credentials, open Windows Terminal, launch WSL 2, open AnyConnect, establish the VPN connection, change the network interface metric (which, yes, I know I could probably now script using task scheduler and trigger on-event) and then RDP into the machine. But hey, at least Windows doesn't have to reboot all the time anymore |
|
Here is a great blog post which deals with the 3 different VPN issues and why you should not change the Interface Metric to a high number. |
|
@tobyfreemarket very nice post. But this conclusion is close to wrong:
However, it would be interesting to automate the route-drop workaround, and place it in a scheduled task (as found earlier in this thread, specifically for Cisco VPN). |
That's great when you have one catch-all route; but in full-tunnel-default with some split-tunnel exclusions, or where the VPN client enforces/refreshes routes that are deleted, this isn't a suitable solution. |
|
We have activated the BypassVirtualSubnetsOnlyV4 fix of Cisco AnyConnect 4.10, but it did not appear to help. Anyone had success with that fix? |
Probably one for Cisco support I guess, but based on this: https://www.cisco.com/c/en/us/td/docs/security/vpn_client/anyconnect/anyconnect410/administration/guide/b-anyconnect-admin-guide-4-10/troubleshoot-anyconnect.html#Cisco_Task_in_List_GUI.dita_3a9a8101-f034-4e9b-b24a-486ee47b5e9f |
works for me! Thank you! |
|
I'm having this issue in December 2022 on an up to date version of Windows 10 with WSL 2 and the latest Ubuntu from Microsoft Store. I agree with the others here that setting the metric high is not the answer - additionally these solutions do not consider developers that do not have administrative rights on their machine due to corporate policy. Part of the issue I'm experiencing is the DNS issue where I have to manually set the DNS IP address in the /etc/resolv.conf However, even after doing this sporadically I'll be unable to even ping an IP address directly leading me to believe that there still are some issues to be resolved with how the network adapters are handled by Windows. Just wanted to share my experience. P.S. - I wrote up an automatic powershell script to handle the DNS issue - but still have the other issue sporadically I described. I guess I'll take 50% working over 0% working? |
Finally the BypassVirtualSubnetsOnlyV4 fix from Cisco solved it for us! No more messing with interface metric workarounds. |
This was actually my problem, Cisco VPN had connected status (even when disconnected). By chaging the priority of the Cisco one, the WSL2 variant started working again. Also changed my WiFi (primary interface) to priority of 1. Thanks and you rock!! |
and others
Please fill out the below information:
Your Windows build number: (Type
verat a Windows Command Prompt)Microsoft Windows [Version 10.0.18932.1000]
What you're doing and what's happening: (Copy&paste the full set of specific command-line steps necessary to reproduce the behavior, and their output. Include screen shots if that helps demonstrate the problem.)
I've installed ubuntu 18.04 and converted it to wsl v2 using the following command in windows powershell running as administrator.
PS C:\WINDOWS\system32> wsl --set-version Ubuntu-18.04 2
When I start the Ubuntuu 18.04 instance I'm able to communicate with resources using IPs and hostnames.
Once I connect to my work VPN using cisco annyconnect client v 4.7.00136 I'm not longer able to connect to IP resources.
I should be able to ping 8.8.8.8 or other outside IPs once the annyconnect vpn client is running.
The text was updated successfully, but these errors were encountered: