VPN Service of the University Computer Centre

Access to the following private address spaces is possible parallel to the VPN connection:

• 192.168.0.0/16

If these address spaces are used in the local network, access to local network resources (e.g. printers) is possible.

When using Cisco Secure Client, make sure that access to the LAN is permitted in the settings.

In principle, yes. However, the following should be noted. A new IP address is assigned to your computer when the VPN connection is established. This changes the identity of your computer to the AFS server. There have already been examples where this has led to AFS problems on the user side. Therefore, the following advice on how to proceed:

• Terminate the AFS client before establishing the VPN connection.
• Start the VPN connection.
• Starten AFS client again.

The same applies to terminating the VPN connection. Make sure that the AFS client is terminated before the connection is terminated.

When using a TLS-based VPN client:

• TCP-Port 443 TLS
• UDP-Port 443 DTLS

The URZ only offers support for the Cisco Secure Client and eduVPN. The use of alternative VPN clients is possible. Please note the following specifications:

• Installation and configuration of the VPN software is done exclusively by the user.
• The establishment of a VPN tunnel from the Internet to Chemnitz University of Technology is intended for connecting individual workstations. Routing functionality is only permitted for access to an existing local network. For the local newtork addresses from the private 192.168.0.0/16 have to be used.
• The functionality of the VPN connection using alternative VPN software cannot be guaranteed by the URZ.

• Check whether the corresponding data socket supports the access type VPN: overview of the data sockets in public rooms of the university.

If the VPN connection establishment works under Windows, but no data is transferred via the connection, there may be various causes:

1. A network bridge has been installed on the computer. A network bridge is used to use other connections such as Firewire (IEEE 1394) as a LAN connection. To solve the problem, delete the network bridge.
2. Defective firmware of the wireless network card: Try to load a driver update from the manufacturer's website (or from the manufacturer of the chip set). For the following wireless network cards problems are known:
   • Intel PRO/Wireless 2200BG
3. Additionally installed software may have influence on the network access. To solve the problem, please delete this software. Problems in connection with the following products have been reported:
   • NetBalancer
   • Connectify

By default, for secure connections (https) the IE7 checks for blocked server certificates. In doing so, it tries to establish connections to servers in the Internet. Such connections are not permitted before an authentication via VPN client. Therefore, it takes some time until this unsuccessful search is completed (several minutes). Hence, this creates the impression that the network connection does not work. To avoid this behavior, you can deactivate the option “Check for revoked server certificates”

To be found under:

Extras → Internet Options → Tab Extended → Security

After the installation of the VPN client, you can reactivate the option.

Possible reason: At one or more network interfaces, “Internet Connection Sharing” is activated.

Solution: Deactivate sharing the Internet connection.

In Windows OS, the data protection settings should be set to "medium high".

It is possible, that the file /etc/resolv.conf has been changed by the connection setup. If the system does not reset this file after the VPN connection is terminated, the name resolution and thus apparently the Internet access no longer works. The command

sudo dpkg-reconfigure resolvconf

may solve this problem.

Make sure that under „Cisco Secure Client settings” → „Preferences“ the option

• Allow local(LAN) access when using VPN (if configured)

is selected.

If there are still problems with local printing, you must configure your printer statically using the printer IP address. To do this, determine the IP address of your printer. This is often assigned automatically by your internet router. For example, if you are using a Fritzbox, you can find this under Home Network → Home Network Overview → Network Connections

Make sure that the internet router always assigns the same IP address to the printer. In the Fritzbox, select the printer entry and set the option “Always assign the same IPv4 address to this network device”. You can now use this IP address to set up your printer statically under Windows (configuration example Windows 10)

• Windows Settings → Devices → Printer & Scanner
• Add Printer or Scanner → Select “The printer is not listed”
• In the window “Search printer by other options” select “Add Priter by TCP/IP address or hostname” → Next
• In the window “Enter a printer hostname or IP address” enter the IP address → Next
• The printer is set up and can now be used also when the VPN connection is established.

Openconnect does not connect with current Cisco server versions anymore (openconnect bug).

As a workaround you can set the following openconnect option: --useragent=“AnyConnect“

The error occurs after a glibc update.

As a workaround the following change can be made:

Anyconnect up to 4.10.*: Become root and edit /opt/cisco/anyconnect/AnyConnectLocalPolicy.xml

Cisco Secure Client 5.*: Become root and edit /opt/cisco/secureclient/AnyConnectLocalPolicy.xml

Change the line with ExcludeFirefoxNSSCertStore from false to true

The error occurs due an API change by Apple in Mac OS, Cisco Secure Client uses this API from version 5.1 on and therefore needs new authorizations.

To eliminate this error, the background services for Cisco Secure Client must be allowed.

Open the system settings and navigate to “General”.

Open the “Login objects” submenu on the right-hand side.

In the “Allow in background” area, allow the “Cisco Secure Client - AnyConnect VPN Service” by activating the slider to the right.