Skip to content

Conversation

komal-hashi
Copy link

@komal-hashi komal-hashi commented Aug 20, 2025

Description

Tested the issue - ICU-17183 for Cisco Anyconnect VPN and have documented the findings and workaround as part of this PR.

PCI review checklist

  • I have documented a clear reason for, and description of, the change I am making.
  • If applicable, I've documented a plan to revert these changes if they require more than reverting the pull request.
  • If applicable, I've documented the impact of any changes to security controls.
    Examples of changes to security controls include using new access control methods, adding or removing logging pipelines, etc.

@komal-hashi komal-hashi requested review from a team as code owners August 20, 2025 08:02
Copy link

CLA assistant check

Thank you for your submission! We require that all contributors sign our Contributor License Agreement ("CLA") before we can accept the contribution. Read and sign the agreement

Learn more about why HashiCorp requires a CLA and what the CLA includes

Have you signed the CLA already but the status is still pending? Recheck it.

1 similar comment
Copy link

CLA assistant check

Thank you for your submission! We require that all contributors sign our Contributor License Agreement ("CLA") before we can accept the contribution. Read and sign the agreement

Learn more about why HashiCorp requires a CLA and what the CLA includes

Have you signed the CLA already but the status is still pending? Recheck it.

Copy link
Collaborator

@johanbrandhorst johanbrandhorst left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This looks great, thank you Komal! Lets just remove one unnecessary sentence.

```hcl
v4_prefix = "172.16.0.0/12"
```
This configuration was tested successfully and resolved the issue.
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we can remove this line

Suggested change
This configuration was tested successfully and resolved the issue.

Copy link
Contributor

@Dan-Heath Dan-Heath left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you for this update! I think it makes sense and reads well. I added some suggestions per our style guidelines. Please let me know if you have any questions or if I can be of any help.


When you run the Cisco AnyConnect VPN at the same time as the Boundary Client Agent, DNS resolution may fail for Boundary aliases.

**Root cause**:
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
**Root cause**:

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think these paragraphs are short and easy enough to understand that we don't need additional headings here.

When you run the Cisco AnyConnect VPN at the same time as the Boundary Client Agent, DNS resolution may fail for Boundary aliases.

**Root cause**:
The Boundary Client Agent runs on the default IPv4 range `100.x.x.x`. Cisco AnyConnect VPN treats this range as a *secured range*, which forces DNS queries to resolve through the VPN instead of the Boundary Client Agent. As a result, Boundary aliases cannot be resolved.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
The Boundary Client Agent runs on the default IPv4 range `100.x.x.x`. Cisco AnyConnect VPN treats this range as a *secured range*, which forces DNS queries to resolve through the VPN instead of the Boundary Client Agent. As a result, Boundary aliases cannot be resolved.
The Boundary Client Agent runs on the default IPv4 range `100.x.x.x`. Cisco AnyConnect VPN treats this range as a **secured range**, which forces DNS queries to resolve through the VPN instead of the Boundary Client Agent. As a result, Boundary aliases cannot be resolved.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We use bold for emphasis instead of italics because italics can be difficult for some people to see.

**Root cause**:
The Boundary Client Agent runs on the default IPv4 range `100.x.x.x`. Cisco AnyConnect VPN treats this range as a *secured range*, which forces DNS queries to resolve through the VPN instead of the Boundary Client Agent. As a result, Boundary aliases cannot be resolved.

**Workaround**:
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
**Workaround**:

The Boundary Client Agent runs on the default IPv4 range `100.x.x.x`. Cisco AnyConnect VPN treats this range as a *secured range*, which forces DNS queries to resolve through the VPN instead of the Boundary Client Agent. As a result, Boundary aliases cannot be resolved.

**Workaround**:
You can configure the Boundary Client Agent to use a different IPv4 prefix by setting the `v4_prefix` option in the client configuration file. This overrides the default `100.x.x.x` range and avoids the conflict with Cisco AnyConnect VPN.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
You can configure the Boundary Client Agent to use a different IPv4 prefix by setting the `v4_prefix` option in the client configuration file. This overrides the default `100.x.x.x` range and avoids the conflict with Cisco AnyConnect VPN.
You can configure the Boundary Client Agent to use a different IPv4 prefix by setting the `v4_prefix` option in the client configuration file. This setting overrides the default `100.x.x.x` range and avoids the conflict with Cisco AnyConnect VPN.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Minor rewrite to make it more clear what "This" refers to.

Comment on lines 789 to 795
<Note>
The `v4_prefix` can be set to any valid RFC1918 private IPv4 range, as long as it does not overlap with ranges secured by the VPN. Common options include:
- `10.0.0.0/8`
- `172.16.0.0/12`

Choose a range that best fits your environment.
</Note>
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
<Note>
The `v4_prefix` can be set to any valid RFC1918 private IPv4 range, as long as it does not overlap with ranges secured by the VPN. Common options include:
- `10.0.0.0/8`
- `172.16.0.0/12`
Choose a range that best fits your environment.
</Note>
<Note>
You can set the `v4_prefix` to any valid RFC1918 private IPv4 range, as long as it does not overlap with ranges secured by the VPN. Common options include:
- `10.0.0.0/8`
- `172.16.0.0/12`
Choose a range that best fits your environment.
</Note>

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Minor rewrite to use active voice instead of passive ("You can set...").

I added a line space before the bulleted list so it renders correctly. I also added a line space after the opening Note and before the closing Note to ensure that your Markdown renders correctly.

@Dan-Heath Dan-Heath added this to the deferred milestone Aug 20, 2025
Copy link
Collaborator

@johanbrandhorst johanbrandhorst left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants