AnyConnect Autoreconnect ReconnectOnResume dosen't work

Question

Hello! I have an issue with anyconnect and computers hibernating. I'm in the process of migrating a customer from ipsec to anyconnect. We want to make the VPN connection as seamless as possible but without enabling always-on. For now we just want an one-to-one switch with ipsec and anyconnect.
Always-on will probably be implemented later after some testing and validation. Now to my issue: I have been trying to make our computers reconnect after hibernation without the need to re-authenticate but I can't seem to get it to work. We are using anyconnect version 3.1.04066 and using ipsec (ikev2) as the connection protocol. In our anyconnect profile I have enabled Auto Reconnect and set it to ReconnectOnResume. Se profile below. I'm currently not pushing any configuration from the ASA. It's strange cause after hibernate I get the following error even though ReconnectOnResume is configured: "The VPN connection has been disconnected due to the system suspending. The reconnect capability is disabled. A new connection is necessary, which requires re-authentication" Can I get some help troubleshooting this.
XML profile (company name removed):
<?xml version="1.0" encoding="UTF-8"?>
<AnyConnectProfile xmlns="http://schemas.xmlsoap.org/encoding/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://schemas.xmlsoap.org/encoding/ AnyConnectProfile.xsd">
<ClientInitialization>
<UseStartBeforeLogon UserControllable="false">false</UseStartBeforeLogon>
<AutomaticCertSelection UserControllable="false">true</AutomaticCertSelection>
<ShowPreConnectMessage>false</ShowPreConnectMessage>
<CertificateStore>Machine</CertificateStore>
<CertificateStoreOverride>true</CertificateStoreOverride>
<ProxySettings>IgnoreProxy</ProxySettings>
<AllowLocalProxyConnections>true</AllowLocalProxyConnections>
<AuthenticationTimeout>12</AuthenticationTimeout>
<AutoConnectOnStart UserControllable="false">true</AutoConnectOnStart>
<MinimizeOnConnect UserControllable="true">true</MinimizeOnConnect>
<LocalLanAccess UserControllable="false">false</LocalLanAccess>
<ClearSmartcardPin UserControllable="false">true</ClearSmartcardPin>
<IPProtocolSupport>IPv4,IPv6</IPProtocolSupport>
<AutoReconnect UserControllable="false">true
<AutoReconnectBehavior UserControllable="false">ReconnectAfterResume</AutoReconnectBehavior>
</AutoReconnect>
<AutoUpdate UserControllable="false">false</AutoUpdate>
<RSASecurIDIntegration UserControllable="false">Automatic</RSASecurIDIntegration>
<WindowsLogonEnforcement>SingleLocalLogon</WindowsLogonEnforcement>
<WindowsVPNEstablishment>LocalUsersOnly</WindowsVPNEstablishment>
<AutomaticVPNPolicy>true
<TrustedDNSDomains><company>.org,<company>.org</TrustedDNSDomains>
<TrustedDNSServers>10.80.255.205,10.80.255.206,10.80.255.207</TrustedDNSServers>
<TrustedNetworkPolicy>Disconnect</TrustedNetworkPolicy>
<UntrustedNetworkPolicy>Connect</UntrustedNetworkPolicy>
<AlwaysOn>true
<ConnectFailurePolicy>Closed
<AllowCaptivePortalRemediation>true
<CaptivePortalRemediationTimeout>7</CaptivePortalRemediationTimeout>
</AllowCaptivePortalRemediation>
<ApplyLastVPNLocalResourceRules>true</ApplyLastVPNLocalResourceRules>
</ConnectFailurePolicy>
<AllowVPNDisconnect>true</AllowVPNDisconnect>
</AlwaysOn>
</AutomaticVPNPolicy>
<PPPExclusion UserControllable="false">Disable
<PPPExclusionServerIP UserControllable="false"></PPPExclusionServerIP>
</PPPExclusion>
<EnableScripting UserControllable="false">false</EnableScripting>
<CertificateMatch>
<KeyUsage>
<MatchKey>Key_Encipherment</MatchKey>
<MatchKey>Digital_Signature</MatchKey>
</KeyUsage>
<DistinguishedName>
<DistinguishedNameDefinition Operator="Equal" Wildcard="Enabled" MatchCase="Enabled">
<Name>ISSUER-CN</Name>
<Pattern><company> Issuing CA v1</Pattern>
</DistinguishedNameDefinition>
</DistinguishedName>
</CertificateMatch>
<EnableAutomaticServerSelection UserControllable="false">false
<AutoServerSelectionImprovement>20</AutoServerSelectionImprovement>
<AutoServerSelectionSuspendTime>4</AutoServerSelectionSuspendTime>
</EnableAutomaticServerSelection>
<RetainVpnOnLogoff>true
<UserEnforcement>SameUserOnly</UserEnforcement>
</RetainVpnOnLogoff>
</ClientInitialization>
<ServerList>
<HostEntry>
<HostName>test.<company>.com</HostName>
<HostAddress>test.<company>.com</HostAddress>
<UserGroup>anyc-tunnel-v1.0</UserGroup>
<MobileHostEntryInfo>
<NetworkRoaming>true</NetworkRoaming>
<CertificatePolicy>Auto</CertificatePolicy>
<ConnectOnDemand>false</ConnectOnDemand>
<ActivateOnImport>false</ActivateOnImport>
</MobileHostEntryInfo>
<PrimaryProtocol>IPsec</PrimaryProtocol>
</HostEntry>
</ServerList>
</AnyConnectProfile>

Answer 1

I am glad to know that it is working now. Thank you for confirming that my suggestion that the profile needed to be specified in the configuration of the ASA. I am not authoritative on how it works but my interpretation is that since there can be multiple profiles in the directory of the PC that the ASA must indicate to the client when the connection is established which profile is to be used. For example I use AnyConnect to connect to multiple ASAs for multiple customers and have multiple profiles in the directory of my PC. When I establish a connection how will my AnyConnect client know which profile to use for this connection?
So when you deploy the profile in the way that was intended it works and when you deploy in a different way it does not work.
HTH
Rick