Cisco AnyConnect IPv6 Problem — Websites Stop Loading After VPN Connects

When you connect to a VPN with Cisco AnyConnect and IPv6 is in use, you can run into a nasty problem: websites stop loading in the browser.

It looks as if the routes pushed by the VPN shouldn’t get in the way: ping works and names resolve, but web traffic doesn’t.

The fix

It turns out this is an old problem with a very simple solution.

Enable Client Bypass Protocol in the Group Policy of the tunnel you connect to. You do this in the VPN server settings on the Cisco ASA. From the CLI:

group-policy YOUR_POLICY attributes
 client-bypass-protocol enable

Why it helps: the ASA gives the client only an IPv4 address. With Client Bypass Protocol disabled, the IPv6 traffic for which no address was assigned is dropped, so sites that prefer IPv6 stop loading. With the option enabled, that traffic is sent outside the tunnel and the sites work again.

Trade-off: that IPv6 traffic does not go through the VPN. If everything must stay inside the tunnel, assign IPv6 addresses to your AnyConnect clients instead.

After changing the option, reconnect with the Cisco AnyConnect client and the internet should keep working normally.