拆分隧道和Cisco AnyConnect

15

我在Windows 7 64位上使用Cisco AnyConnect安全移动客户端3.1.02026。我听说有一个启用拆分隧道的复选框。但是，由于管理员的设置，此复选框已从GUI中删除。管理员不想进行任何配置更改。我想强制拆分隧道。怎么样？如果解决方案使用其他VPN客户端也可以。该解决方案无法在VPN服务器上进行任何更改。我已经尝试过虚拟机并且可以运行，但是我想要一个更方便的解决方案。我曾尝试弄乱路由表，但由于不知道如何正确操作而失败了。

这是我route print连接到VPN之前的内容。

===========================================================================
Interface List
 14...00 1e 4f d7 64 5b ......Intel(R) 82566DM-2 Gigabit Network Connection
  1...........................Software Loopback Interface 1
 25...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
 27...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.1.1      192.168.1.3     10
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
      169.254.0.0      255.255.0.0         On-link       192.168.1.3     11
  169.254.255.255  255.255.255.255         On-link       192.168.1.3    266
      192.168.1.0    255.255.255.0         On-link       192.168.1.3    266
      192.168.1.3  255.255.255.255         On-link       192.168.1.3    266
    192.168.1.255  255.255.255.255         On-link       192.168.1.3    266
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link       192.168.1.3    266
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link       192.168.1.3    266
===========================================================================
Persistent Routes:
  Network Address          Netmask  Gateway Address  Metric
      169.254.0.0      255.255.0.0      192.168.1.3       1
          0.0.0.0          0.0.0.0     10.154.128.1       1
===========================================================================

IPv6 Route Table
===========================================================================
Active Routes:
 If Metric Network Destination      Gateway
 27     58 ::/0                     On-link
  1    306 ::1/128                  On-link
 27     58 2001::/32                On-link
 27    306 2001:0:5ef5:79fd:3431:3b25:b736:1859/128
                                    On-link
 14    266 fe80::/64                On-link
 27    306 fe80::/64                On-link
 27    306 fe80::3431:3b25:b736:1859/128
                                    On-link
 14    266 fe80::3933:bb6f:892:d161/128
                                    On-link
  1    306 ff00::/8                 On-link
 27    306 ff00::/8                 On-link
 14    266 ff00::/8                 On-link
===========================================================================
Persistent Routes:
  None

这是我route print连接到VPN之后的。

===========================================================================
Interface List
 19...00 05 9a 3c 7a 00 ......Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows x64
 14...00 1e 4f d7 64 5b ......Intel(R) 82566DM-2 Gigabit Network Connection
  1...........................Software Loopback Interface 1
 25...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
 27...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
167...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #3
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.1.1      192.168.1.3     10
          0.0.0.0          0.0.0.0     10.154.128.1     10.154.159.8      2
     10.154.128.0    255.255.224.0         On-link      10.154.159.8    257
     10.154.159.8  255.255.255.255         On-link      10.154.159.8    257
   10.154.159.255  255.255.255.255         On-link      10.154.159.8    257
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
     137.254.4.91  255.255.255.255      192.168.1.1      192.168.1.3     11
      169.254.0.0      255.255.0.0         On-link      10.154.159.8    306
      169.254.0.0      255.255.0.0         On-link       192.168.1.3    306
  169.254.255.255  255.255.255.255         On-link      10.154.159.8    257
  169.254.255.255  255.255.255.255         On-link       192.168.1.3    266
      192.168.1.1  255.255.255.255         On-link       192.168.1.3     11
      192.168.1.3  255.255.255.255         On-link       192.168.1.3    266
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link       192.168.1.3    266
        224.0.0.0        240.0.0.0         On-link      10.154.159.8    257
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link       192.168.1.3    266
  255.255.255.255  255.255.255.255         On-link      10.154.159.8    257
===========================================================================
Persistent Routes:
  Network Address          Netmask  Gateway Address  Metric
      169.254.0.0      255.255.0.0      192.168.1.3       1
          0.0.0.0          0.0.0.0     10.154.128.1       1
===========================================================================

IPv6 Route Table
===========================================================================
Active Routes:
 If Metric Network Destination      Gateway
 19     11 ::/0                     On-link
  1    306 ::1/128                  On-link
 19    266 fe80::/64                On-link
 19    266 fe80::2a78:5341:7450:2bc1/128
                                    On-link
 14    266 fe80::3933:bb6f:892:d161/128
                                    On-link
 19    266 fe80::c12f:601f:cdf:4304/128
                                    On-link
 19    266 fe80::c5c3:8e03:b9dd:7df5/128
                                    On-link
  1    306 ff00::/8                 On-link
 14    266 ff00::/8                 On-link
===========================================================================
Persistent Routes:
  None
vpn  cisco-anyconnect  split-tunnel 
— 内森
source
— Vadzim

Answers:

7

首先了解您的网络管理员不允许拆分隧道的原因是，它可能允许任何恶意人员/代码规避通过计算机访问网络而实施的安全措施。相信我，我知道没有分开的隧道很烦人，但问问你自己值得冒险吗？

现在，警告已无法解决，我可以告诉您Cisco AnyConnect通过临时重新编写主机的路由表来防止隧道分裂。使用route print您之前启动的AnyConnect和后再次使用它来查看的差异。您可以编写脚本来调整路由表并在启动AnyConnect之后运行它。一个可能不违反您的网络使用策略的简单解决方案是将VM与AnyConnect一起使用。主机的NIC不会被锁定，并且您不会违反任何规则...两全其美。

— 泛素化
source
4
Cisco AnyConnect阻止Windows上的路由调整生效。
— 内森
0

我还没有弄清楚如何使用Cisco AnyConnect拆分隧道。这是我的工作。

我尝试使用VPNC前端，但由于出现一般错误消息而无法修复连接设置。我需要将“应用程序版本思科系统VPN客户端4.8.01（0640）：Linux”添加到default.conf。同样，一旦建立连接，我将无法访问远程LAN中的任何内容。我需要创建一个批处理文件，该文件添加了用于远程LAN IP地址的路由（例如route add 10.0.0.0 mask 255.0.0.0 10.85.37.1 metric 9 IF 180）。同一批文件还必须配置为先使用远程LAN的DNS服务器，然后再使用ISP的DNS服务器（例如netsh interface ipv4 add dns "Local Connection 2" 42.23.24.46 index=1）

要获取更详细的错误消息，我按照BMC上的说明进行操作。我必须安装其他软件包：Net openssl，Devel Libs openssl-devel和Interpreters perl。

— 内森
source
By using our site, you acknowledge that you have read and understand our Cookie Policy and Privacy Policy.
Licensed under cc by-sa 3.0 with attribution required.