I just upgraded my MacBook Air (13-inch, Early 2015) from Sierra to High Sierra 10.13.2. I habitually use Cisco AnyConnect to access my corporate network. I use the macOs built-in ssh client to access servers inside my corporate network.

Since the upgrade I get 'network is down' whenever I try to use ssh over the vpn.

With the Cisco vpn client disconnected I can still ssh to my raspberry pi on my home network.

But with the VPN connected if I try to connect to a work machine I get:

ssh -vvv wspasm03
OpenSSH_7.6p1, LibreSSL 2.6.2
debug1: Reading configuration data /Users/XXX/.ssh/config
debug1: /Users/XXX/.ssh/config line 1: Applying options for *
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 48: Applying options for *
debug2: ssh_connect_direct: needpriv 0
debug1: Connecting to wspasm03 port 22.
ssh: connect to host wspasm03 port 22: Network is down

I tried netcat and it can make a tcp connection to the servers with:

nc wspasm03 22
SSH-2.0-OpenSSH_7.2p2 Ubuntu-4ubuntu2.2

So this is a very odd problem. It feels like ssh is using a different routing table from everything else.

If I run Wireshark capturing the VPN interface I can see netcat making the connection. If I try with ssh I get the 'network is down' error and no packets are captured.

I noticed that the VPN client creates two IP interfaces, utun0 has only an ipv6 address whereas utun1 has both ipv4 and ipv6 addresses. So I tried ssh -4 but that didn't help.

This is my ~/.ssh/config:

Host *
   AddressFamily inet
   CheckHostIP no

This is /etc/ssh/ssh_config (comment and blank lines omitted):

Host *
    SendEnv LANG LC_*

Any ideas?

  • Indeed. Very early. I've never seen this before. – Julian Jan 6 '18 at 15:29
  • 1
    Translated to some German dialect spasm also means crap (besides spasm) – klanomath Jan 6 '18 at 16:12
  • 1
    I'm still investigating the problem... – klanomath Jan 6 '18 at 16:13
  • The ws in that name is relevant. The rest was assigned by someone with no clue. – Julian Jan 6 '18 at 16:14
  • OK, I've built the current version from home-brew and that works. So it is definitely a problem with the apple openssh client in High Sierra. – Julian Jan 11 '18 at 12:47

You must log in to answer this question.

Browse other questions tagged .