Problem when using Win10 internal VPN too

[ajschot]

Hello all,

I am trying to find this problem but i can not find any topic nor find a solution.

The problem is as follows...

My work laptop makes a permanent VPN conncetion with my work, but our team is working in between systems and for some work i need another VPn connection wich uses Pulse Secure.

The connection with Pulse Secure works perfectly fine on top of theother VPN, but when we try to disconnect it seems like the connections stays open.

One application that connects to a server over a certain port is off course only working when the Pulse Secure connection is not on.

After a reboot everything works fine again, but as soon as we used pulse secure to connect to the other vpn server we need to restart to get everything working again.

It seems like a part of the connection is not good disconnected, weird thing webpages that are internal from my work VPN (internal windows IKEv2) work fine so weird that for instance some ports are not well working.

Someone knows a solution? It is not possible to disconnect and reconnect the office VPN...

[ajschot]

i have found a temporary solution, disconntect wifi and or LAN (or use Airplane mode), but is there an other solution?

[[email protected]]

@ajschot Access to the internal server is working before connecting to Pulse , but stops after connecting to Pulse. In order for it work again, you have to reboot the machine. IKEv2 is the base VPN connection and on-top which you're connecting to Pulse and the resources which you can access after connecting to IKEv2 is intact.

Is my understanding correct?

Do you know what type of tunnel being pushed by pulse secure? full tunnel or split tunnel? I think it'd be mostly split tunnel.

Do you see any changes in the route table after connecting to Pulse w.r.t internal server ip/subnet that you're not able to access?

[ajschot]

thanks for your time,

Yes the work VPN (IKEv2) is hard internal windows vpn that is suppose to be always connected, and on top of that we need to use Pulse Secure. And yes the Pulse Secure vpn is a spilt tunnel.

So for now... disconnect Pulse Secure and do a reboot or disconnect from the internet is the only way to reaquire the work vpn. (Reboot, flightmode, pull the cable or disconnect from the WiFi is all working) not the best solutions that is why i ask if someone knows a solution.

[[email protected]]

@ajschot After disconnecting the Pulse Secure VPN, are we able to see any traffic sent to the IKEv2 leaving from the machine?

If the IKEv2 is not working after Pulse disconnection, then I'd like to see if the Ikev2 is able to stay connected? Is it stable but not sending any traffic through ike tunnel?

Is the DNS resolutions fail after pulse disconnected?

[ajschot]

Thanks for your help, i will look into this thursday i don't have a machine by hand now. 
I thought it was partly having traffic (we  traffic) but that would be weird so i will have to check this to be sure.

[ajschot]

Hey i checked this, when pulse secure is active the DNS server is changed to the network from the Pulse Secure connection. 

Before and after the Pulse Secure connection is no difference also the dns server is back to where it should be. But the strange thing is, that i can confirm, the ports for websites are working well, so some internal sites that are only working on the office VPN (Internal Windows 10 IKE2v) all communication over standard ports is comming back good, the problem is that we use software that uses a not normal port and it is working before we use Pulse Secure, but after disconnecting this port (180) is not reacheable (we use an static IP address so DNS is not involved). But all the internal websites works well.

It is strange that some ports are going switching well but not all traffic is routed back via the right way. Also when useing Pulse Secure it seems that the office VPN still works.

[zanyterp]

i'm not sure why it is working at all; i know that vpn over vpn will experience potential failures
is there overlap between the pulse subnets and the ikev2 subnets?
does the acl show all ports allowed?