We have a Pulse Connect Secure appliance which we use for client VPN, as well as hosting some external websites.
We have an odd issue where, while a user is connected to Pulse VPN (no split tunneling), they are unable to access any web pages which are hosted by an external virtual port which is also on the same Pulse appliance. However, they are still able to load other websites from the same external IP range which are not hosted on the Pulse appliance.
Doing a traceroute to the external virtual port on the Pulse appliance from the VPN client just times out. The traffic doesn't go to the default gateway, but just appears to get eaten by the appliance.
Oddly, if I do a simultaneous packet capture from both the Pulse appliance and the VPN client, here is what I observe:
- From the client on VPN, the traffic goes out, but no response comes back.
- From the Pulse appliance (monitoring all interfaces), I see the appliance responding to the clients requests, but I don't actually see the initial requests show up within the packet capture.
It's as if the Pulse appliance is just internally routing the connection to itself, but then externally responding out the external interface to the private VPN IP, which obviously isn't going to go anywhere.
Does anyone know why this behavior is such and if there is a resolution to it?
