[aronymous]

Hi, I am a new Crackberry member, and wanted some help.
I have to connect my VPN to access work mail ID and when I do that all other applications (BBM,Whatsapp, Browsing, Gmail) etc dont work.
I have 3 mail IDs configured to the device, 2 personal; and 1 work.

I was using BB 9790 earlier and all mail IDs used to work correctly, i didnt have to use VPN for my work ID too.
Last week I got my Q10, and I asked my office IT administrator (we are not on BES) to help me configure my work ID. He said for OS10, I will need to have VPN configured for accessing emails. So he setup the Mail Account (Microsoft Exchange ActiveSync) and created the VPN profile on the handset, with Gateway Type: Cisco ASA; Authentication Type: XAUTH-PSK; with other particulars pertaining to ID/password etc. As per him, I need to keep VPN connected always so that I can send/receive emails on my work account. But now whenever the VPN is connected, no other internet facing applications work; gmail/yahoo - i can not send/receive emails; no browsing possible.

The VPN ID/Password entered in the device, is the same we enter for our office laptops too, wherein browsing internet is very much possible. So I do not think VPN profile could be an issue.

Requesting for help and advice since connecting/disconnecting VPN makes me lose out on important emails.

[Branta]

Sounds like your admin gave you EAS permissions to have the phone allow email only.

[kja123]

All internet traffic will be routed through the VPN connection if you activate VPN. As far as I know there is no way to route just specific services through a vpn connection in bb10 yet.
Did you asked your admin if he has blocked bbm, internet browsing etc. in your company firewall?

Posted via CB10

[js8229]

I'd ask your admin to verify you can get through to the internet via VPN. Does your browser work while on VPN? If so, it might just be firewall/configuration on the VPN not allowing certain ports/protocols through. If the browser doesn't work, then it would seem you don't have internet access through your VPN at all.

[mjolnirgs]

That's expected behavior with the Cisco ASA. When the VPN is connected, as a security feature, many companies force all traffic into the VPN when connected, even if the traffic is not destined for servers on the corporate network. The ASA has a feature called split tunneling which allows traffic not destined for corporate servers to go right out the users' internet connection, unfortunately, Many devices do not accept this configuration and route all traffic into the VPN anyway. Because of the way the ASA is designed (not conffigured), the traffic not going to the internal network gets dropped.

You need a proxy server on the internal network set up to make web requests on your behalf when connected to the VPN. Thats what I do for the devices on my network that cannot handle the split tunnellng (Not just Blackberries) In the VPN setup on your phone is a spot to configure the proxy.

If you don't get what I'm saying, point your firewall admin at this thread, he'll get it.


Posted via CB10

[aronymous]

@MjolnirGS --- Like you have suggested, I have shown your message to my IT Admin. He said he will check out whats possible.
Let me see what he suggests...he sounds already hassled by my frequent interruptions

@ js8229 , Branta & kja123--- I do get connected to internet while on my corporate VPN. Its only on the BB Q10, that the internet applications are not working. My IT Admin also mentioned there is no other restriction on the VPN with respect to Internet applications.

[pwan10]

So I decided to try the VPN again from my Z10 after seeing this post and it seems like Split Tunneling is now allowed on the Z10. I am able to VPN into my corporate environment, access my internal systems, and access the Internet without the use of a Proxy Server.

Once you are connected to your VPN, go into the VPN logs on your Z10. For each split tunnel network you have defined in your firewall (I am using Cisco ASA), you will see 4 corresponding log messages.
-Subnet
-subnet mask
- default gateway
- interface

Not sure when Blackberry allowed this as too was frustrated with the lack of split tunneling support, but I am glad they added it!!

[ttsaon]

How to setup a VPN on blackberry z10

Setup & Use IPSEC VPN
Click on settings
Go to network connections
Click on VPN
Fill in the required setting:
Click ADD NEW VPN PROFILE
Name the profile
Input a gateway/server location
Gateway type: Cisco Secure PIX Firewall VPN
Authentication Type: XAUTH-PSK
Group Username: ipsec
Group Password: ipsec
Hard Token: leave unchecked
Enter your VPN username
Enter your VPN password
Save and Connect

[redmonke255]

All internet traffic will be routed through the VPN connection if you activate VPN. As far as I know there is no way to route just specific services through a vpn connection in bb10 yet.
Did you asked your admin if he has blocked bbm, internet browsing etc. in your company firewall?

Posted via CB10

It is possible. The Vpn for my university allows me to route only its network sites or all data.

The Vpn address is different depending on what I want, I had same symptoms as OP. Definitely get IT to give you the right one.

Posted via Q10