AnyConnect client 3.1.04063 Windows 7 x64 users cannot make ssl connection

Over the past week several of my users have suddenly found they cannot connect with a previously working client. After the login banner is accepted they all get an error message "The certificate on the secure gateway is invalid. A VPN connection will not be established." Then another message "AnyConnect was not able to establish a conenction to the specified secure gateway. Please try connecting again." On the ASA 5540 logs I see successful authentication and then the device is trying to establish a ssl session which is denied and then connection is terminated.
I have verfied that the ssl certificates are valid and are installed in the trusted root certificates location. I have checked that ICS is disabled. I have checked that the vpn adapter display name is correct.
Does anyone have any ideas?

We are not using a self signed cert. We have a cert issued by the DoD. It seems like a user who had previously connected and is on Windows 7 x64 will not be able to connect. Users who have never connected and browse to the site will be able to successfully connect.
Additional information: I have cleared all DoD related certs and the server cert from the certmgr.msc on an affected Windows box. Uninstalled the AnyConnect application and all remnant files. Cleared SSL cache on both IE and Firefox browsers. I rebooted then tried connecting via the web address but am receiving the same issue.

Similar Messages

Enforce AnyConnect client to do machine authentication when user is logged on

Hi All,
I want to use AnyConnect as a supplicant to our corporate WLAN and also use Machine Authentication feature on ACS 5.3.
Is there a way how to enforce AnyConnect client to do machine authentication when user is logged on? Sometimes can happen, when user just hybernate the computer and do not log off and log on. If they don't do this in some period, then they are not allowed to use WLAN.
Thanks for your help.
Regards
Karel

The problem appears to be if a user hibernate or ACS is reloaded and machine authentication timer expired and user need to logout and wait or reboot the machine. After that it authenticates and then user can login again. Anyconnect 3.1 will allow eap chainging and should be able to address that problem.

Windows AD user cannot use Promotion management, Why?

A Procedure is distributed by SAP how to Use ”Promotion Management” in a OTAP/ DTAP street.
See Chapter/Secton 05 of this document: https://archivesaptechedhandson.hana.ondemand.com/contentArchive/AP263_Exercises_VHO_FINAL.pdf
This is a very good/useful procedure. This procedure works with an “Enterprise” Account.
In our environment we ONLY work with “Windows AD” accounts. (to keep users management very straight forward.)
We do not get the procedure working with “Windows AD” account.
Our procedures stops at Section: “07.3 Add to VM”:
The selected webi document, within the promotion Job, is not getting "checked in" in Version Management.
After that all other steps are useless.
Windows AD user cannot use Promotion management, but Why?
(If we use version managment on the individual webi report, with a windows AD user everyting works fine)

Sebastian,
you showed us the right direction.
We run SAP BusinessObjects BI Platform 4.1 Support Pack 2 Patch 3.
In SAPBO4.1 we had to extend the properties of 2 services:
AdaptiveJobServer and the AdaptiveProcessingServer.
Now we can use windows active directory for promotion management,
thanx.

AnyConnect Client (3.1.02040) - Windows 8 won't shut down

I've noticed and issue with Windows 8 and AnyConnect Client version 3.1.02040. I've tried various things to try to resolve this issue but have hit a brick wall. Whenever, I run AnyConnect on my Windows 8 PC and then shut it down for the day, the PC won't turn off. I've ensured my AnyConnect client is disconnected and then quit the application and even killed the VPN service.
Has anyone else seen this issue??? Any resolution???

I also have the same problem. There is a few things that I have noticed...
1. If you disable the Network List Service and the Network Location awareness Services and reboot, this problem does not occure. However, when you disable these services, you are no longer able to manager you network connections.
2. There are many errors that appear in the cisco anyconnect secure mobility client event log
System
Provider
[ Name]
acvpnagent
EventID
2
[ Qualifiers]
9216
Level
2
Task
1
Keywords
0x80000000000000
TimeCreated
[ SystemTime]
2013-02-28T20:36:21.000000000Z
EventRecordID
942
Channel
Cisco AnyConnect Secure Mobility Client
Computer
PC2578.swgao.int
Security
EventData
Function: CThread::invokeRun File: .\Utility\Thread.cpp Line: 435 Invoked Function: IRunnable::Run Return Code: -32112629 (0xFE16000B) Description: BROWSERPROXY_ERROR_NO_PROXY_FILE
Provider
[ Name]
acvpnagent
EventID
2
[ Qualifiers]
9216
Level
2
Task
1
Keywords
0x80000000000000
TimeCreated
[ SystemTime]
2013-02-28T20:36:21.000000000Z
EventRecordID
940
Channel
Cisco AnyConnect Secure Mobility Client
Computer
PC2578.swgao.int
Security
EventData
Function: CVirtualAdapter::IsVAEnabled File: .\WindowsVirtualAdapter.cpp Line: 2685 Invoked Function: CVirtualAdapter::IsVAEnabled Return Code: -33554423 (0xFE000009) Description: GLOBAL_ERROR_UNEXPECTED Unexpected VA status bits, 25174019
System
Provider
[ Name]
acvpnagent
EventID
2
[ Qualifiers]
9216
Level
3
Task
1
Keywords
0x80000000000000
TimeCreated
[ SystemTime]
2013-02-28T20:36:21.000000000Z
EventRecordID
936
Channel
Cisco AnyConnect Secure Mobility Client
Computer
PC2578.swgao.int
Security
EventData
Function: CVAMgr::cleanupAddress File: .\VAMgr.cpp Line: 2449 Invoked Function: CNetshDeleteAddress::Run Return Code: -31064051 (0xFE26000D) Description: NETSHCOMMAND_ERROR_PARSE_FAILED
I'm not sure what anyconnect is doing, but it appear when disconnecting something is prevting it from resetting all of the network settings.

Helpdesk Report Group Users - Cannot create a connection to data source 'DataSource1'

Getting the following error for a User accessing the report who is a member of the reporting group. If I add them as a sysadmin in SQL they can get access. What permissions need changing for this user group?
Cannot create a connection to data source 'DataSource1'. ---> System.Data.SqlClient.SqlException: Login failed for user

Dave,
For a complete understanding of the permission and groups, I would rather suggest you to do the installation of the MBAM components in a single server infrastructure in a test environment.
Create the following domain security groups and use it during the configuration of the MBAM roles:-
1) MBAM Advanced Helpdesk Users
2) MBAM Helpdesk Users
3) MBAM Report Users
4) MBAM Read and Write Access
5) MBAM Read Only Access.
Create an application pool account and create a login in SQL for it. Use it only during:-
1) Configuration of "Compliance and Audit Database connection"
2) Configuration for All Web Applications.
If your application pool account is not a domain administrator, the run the following powershell command to set the service principal name :-
Setspn
-s http//<FQDN of MBAM Web Server> domain\<Application pool account>
Make sure the application pool account must be trusted for delegation.
That's all you need to do. Then after the installation you can check the properties of each group in SQL to verify the rights and permission assigned during the installation.
Regards, "Gaurav Ranjan" =========== NOTE: Mark as Answer and Vote as Helpful if it helps =======

Windows 7 Users Can No Longer Connect to Shared Xserve Drive

We've had multiple computers (both PCs and Macs) setup to use a shared Xserve. All the sudden today the mapped network drives stopped working. I've tried using the "Map network drive" option on Windows 7 to add them manually again, but every time I enter the username/password it says it is not correct. I'm mapping the drive to Z and the folder to '\\10.10.10.77\shared' which is the Ethernet 1 of the Server followed by folder name on the Xserve that worked before. I'm confused what username and password it wants here because I've even reset the Xserve passwords and they still don't work and it says underneath that the Domain underneath is the name of the current PC user...
What's going on here? Am I using the correct Folder format and with the correct username and password? This is driving me crazy!

After hours and hours of constant searching and testing I still can't get it to work?
Any ideas?
I think sharing has changed in Mavericks.

Windows 8 user cannot connect to public OS X Lion share as Guest, keeps asking for a password even though the folder is public?

As title suggests...
OS X Mountain Lion public share works fine for Mac's but as a guest from Windows its adamant it wants a password. If I use proper credentials it will allow me in the public share from the windows PC but I dont want to add creditinatials it should be an open folder to Network (LAN) WORKGROUP users.
OS X Guest account is set to "allow guests to connect to shared folders"
The Public folder is set in "Sharing" as READ ONLY everyone.
Mac's can access the share without needing credentials.
Windows PC asks for Username and Pass (have tried Guest (no password) or just pressing enter (no details)
Searched these forums see a few other people with similar problems yet no Answers
Help please!!

Try this on your PC:
Start->Run...->Open:\\<ipadressofyourmac>\<sharename>
You will be prompted for your username and password.
Or
'My Computer'->'Tools'->'Map network drive...'
enter:
\\<ipadressofyourmac>\<sharename>
in the 'Folder' field.
Click 'Connect using a _different user name_.'.
Enter your server username and password.
Click 'OK'.
Click 'Finish'.

Windows SMB users cannot connect to 10.5.4 server

Hi all,
Have a server running 10.5.4 bound to AD and running an OD to provide management of the Macs. Pretty standard setup and haven't had any problems elsewhere with the same deployment. However we're having a problem with XP users connecting to SMB shares. Mac users can connect over AFP or SMB fine, XP users are getting a "Network path could not be found" error. What's more the errors in the SMB log on the server aren't too descriptive. We're getting a few broken pipe errors, but no indication of what's causing that. XP machines don't appear to be getting to the authentication stage.
Server is an Xserve with a Promise RAID, shares are on a 4TB partition, bound to AD (OD not running Kerberos). SMB setup seems to be correctly aware of the AD.
Anyone any ideas?
Thanks

Is your SMB a Standalone or Domain Member?
I have a similar problem and noticed that if I change SMB from "Domain Member" to Standalone Windows users can connect. Now every so often Leopard Server will change SMB back to a Domain Member (automatically).
I have the Server bound to AD. AFP works for the Macs no matter what. Mac Users authenticate to AD and mount the share. However if they try to use SMB, it fails for the Macs as well if SMB is a Domain Member.
I would like to stop Leopard from not reverting back or fix the "domain member" problem.
The fact that I can connect while it's a Standalone suggests, to me, that it's not a permissions problem. As well the failure carries to the Mac side means it's not a Windows issue.

Windows XP User cannot connect to OS X Server... Keeps asking for password.

I have made my iMac G5 into a server. It is running OS X Server 10.5.7 with all updates. Only use it for file sharing. Have it setup as a standard server. Only have two users and can verify that SMB is running through the Server Admin application.
I use XP Pro with SP3 on my MacBook Pro. Both machines have relativley fresh installs that are unaltered. Both the windows side of my laptop as well as the SMB are set to the same workgroup.
When I am in XP I do the following:
1. Double click on My Network Places
2. In the My Network Places Window I click on the left hand column: View Workgroup Computers
3. I see my server: iMac Server (Imacserver)
4. Double click that icon... get a user login window with the title: Connect to imacserver.private
5. Input my user name and password (the same that I would use while in Leopard... which works fine) - Click OK.
Here is what I don't understand.
6. The login window comes back after about 10-15 seconds. As if the login was incorrect to try again.
7. The user name field now has in front of my name the name of the 'PC' forward slash my user name?? For example: MACPC24335\username
Why can I not connect to my server... in leopard it is very seemless and works fine... I feel that I am over looking something. Any thoughts or ideas as to why this is not working?
Thank you for your time.

Try this on your PC:
Start->Run...->Open:\\<ipadressofyourmac>\<sharename>
You will be prompted for your username and password.
Or
'My Computer'->'Tools'->'Map network drive...'
enter:
\\<ipadressofyourmac>\<sharename>
in the 'Folder' field.
Click 'Connect using a _different user name_.'.
Enter your server username and password.
Click 'OK'.
Click 'Finish'.

Some Windows 8 users cannot connect to 1142N Autonomous

Hi folks,
I have got an issue with some Window 8 devices here. I am not sure if this is a misconfiguration or firmware issue.
Please have a look my config. Any help will be highly appreciated.
Thanks.
hostname QXAP2
logging rate-limit console 9
enable secret 5 $1$aQGz$y42twDoPdQJgJasegu0oj.
no aaa new-model
no ip routing
no ip cef
ip dhcp-server 192.168.0.50
dot11 syslog
dot11 ssid QXAP2
vlan 1
authentication open
authentication key-management wpa version 2
guest-mode
wpa-psk ascii 7 09415718015445414F
dot11 network-map
dot11 guest
crypto pki trustpoint TP-self-signed-1329179707
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-1329179707
revocation-check none
rsakeypair TP-self-signed-1329179707
crypto pki certificate chain TP-self-signed-1329179707
certificate self-signed 01
quit
ip ssh version 2
bridge irb
interface Dot11Radio0
no ip address
no ip route-cache
encryption vlan 1 mode ciphers aes-ccm tkip
ssid QXAP2
antenna gain 128
station-role root
interface Dot11Radio0.1
encapsulation dot1Q 1 native
no ip route-cache
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 spanning-disabled
bridge-group 1 port-protected
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
interface Dot11Radio1
no ip address
no ip route-cache
shutdown
antenna gain 0
peakdetect
no dfs band block
channel dfs
station-role root
interface Dot11Radio1.1
encapsulation dot1Q 1 native
no ip route-cache
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 spanning-disabled
bridge-group 1 port-protected
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
interface GigabitEthernet0
no ip address
no ip route-cache
duplex auto
speed auto
interface GigabitEthernet0.1
encapsulation dot1Q 1 native
no ip route-cache
bridge-group 1
bridge-group 1 spanning-disabled
no bridge-group 1 source-learning
interface BVI1
ip address 192.168.0.254 255.255.255.0
ip helper-address 192.168.0.50
no ip route-cache
ipv6 address dhcp
ipv6 address autoconfig
ipv6 enable
ip default-gateway 192.168.0.1
ip forward-protocol nd
ip http server
ip http secure-server
ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag
ip route 0.0.0.0 0.0.0.0 192.168.0.1
bridge 1 route ip

Your using WPA2, so you should just use aes:
encryption vlan 1 mode ciphers aes-ccm

How to configure terminal services in Windows 2012 server to make multiple connection simulteniously

Hi I am configuring a Windows Server 2012 in a way so that 10 user can access this server through remote desktop connection simultaneously. We have purchased 10 UserCal license for this server.
Please guide me step by step ho to configure this server?

Server comes with 2 concurrent administrative RDP sessions. To enable it in server manager:
Click Yes on the pop-up message to enable the corresponding firewall rule.
To use more than 2 concurrent sessions, you need RDS. See this blog post
for how-to. Note that there's an RDS license required. This
this post for RDS features.
Sam Boutros, Senior Consultant, Software Logic, KOP, PA http://superwidgets.wordpress.com (Please take a moment to Vote as Helpful and/or Mark as Answer, where applicable)

Guest users cannot see or connect to shares on Snow Leopard 10.6.1

I recently upgraded to Snow Leopard from 10.5. After upgrading, users connecting as "guest" to my computer cannot see any of the shares (and therefore cannot connect to them).
If I connect as my administrator user from another computer, I can see all the shares, as well as all the volumes.
I have verified that the Guest Account is enabled (Allow guests to log in to this computer) in the Accounts preference pane, and of course File Sharing is turned on in the Sharing pane, and all the shares are listed with the correct permissions.
This is a very strange and perplexing problem. Any help would be most appreciated!

If they are connecting as a registered user they can see all the shares....but as a guest they cannot...I'm trying to find what might causes that problem....I really cannot think any logical reason... Everything in my options seems to be ok... So after the 10.6.2 update your problem solved ? I think that you were very lucky man...If you find any answer to that problem please let me know...
Anyway,Thank you for your reply!

Windows 8.1 cannot find network connections

i have installed windows 8.1 through boot camp on my retina macbook pro with osx mavericks 10.9.1 2 times now and both times it cannot find my network. ive read online and tried everything and nothing works. i would like to get this resolved because my windows partition is basically useless without internet connection. thanks in advance

When you are using Microsoft Account to login to Windows 8.1, you could work offline and you could just sign-in with your account without connecting to internet.

Users cannot sign in connected with wifi at home

Hey
I need some urgent help with that issue:
My clients report that they can't sign in to Lync app when they conneted to
WiFi at home
when they are trying to connect Lync through 3G or 4G with "auto detect server" - it does works great!
I don't really know why it happens but I guess it is someting with DNS maybe?
please note that it happen only with iOS devices
Thanks!

Clients sign in using DNS so the first thing to check is if the clients are correctly able to resolve lyncdiscover.contosso.com. Also check 3G\4G to compare DNS resolving to correct\expected IP's
You haven't mentioned if its the same device they are using or what version of Lync we are talking about here. Also, do you have a mobile APN for your organization? If so the 3G\4G could be considered as on the WAN.
Please remember, if you see a post that helped you please click Vote As Helpful; and if it answered your question, please click
Mark As Answer
UC Sorted

AnyConnect error " User not authorized for AnyConnect Client access, contact your administrator"

Hi everyone,
it's probably just me but I have tried real hard to get a simple AnyConnect setup working in a lab environment on my ASA 5505 at home, without luck. When I connect with the AnyConnect client I get the error message "User not authorized for AnyConnect Client access, contact your administrator". I have searched for this error and tried some of the few solutions out there, but to no avail. I also updated the ASA from 8.4.4(1) to 9.1(1) and ASDM from 6.4(9) to 7.1(1) but still the same problem. The setup of the ASA is straight forward, directly connected to the Internet with a 10.0.1.0 / 24 subnet on the inside and an address pool of 10.0.2.0 / 24 to assign to the VPN clients. Please note that due to ISP restrictions, I'm using port 44455 instead of 443. I had AnyConnect working with the SSL portal, but IKEv2 IPsec is giving me a headache. I have stripped down certificate authentication which I had running before just to eliminate this as a potential cause of the issue. When running debugging, I do not get any error messages - the handshake completes successfully and the local authentication works fine as well.
Please find the current config and debugging output below. I appreciate any pointers as to what might be wrong here.
: Saved
ASA Version 9.1(1)
hostname ASA
domain-name ingo.local
enable password ... encrypted
xlate per-session deny tcp any4 any4
xlate per-session deny tcp any4 any6
xlate per-session deny tcp any6 any4
xlate per-session deny tcp any6 any6
xlate per-session deny udp any4 any4 eq domain
xlate per-session deny udp any4 any6 eq domain
xlate per-session deny udp any6 any4 eq domain
xlate per-session deny udp any6 any6 eq domain
passwd ... encrypted
names
name 10.0.1.0 LAN-10-0-1-x
dns-guard
ip local pool VPNPool 10.0.2.1-10.0.2.10 mask 255.255.255.0
interface Ethernet0/0
switchport access vlan 2
interface Ethernet0/1
interface Ethernet0/2
interface Ethernet0/3
interface Ethernet0/4
interface Ethernet0/5
interface Ethernet0/6
interface Ethernet0/7
interface Vlan1
nameif Internal
security-level 100
ip address 10.0.1.254 255.255.255.0
interface Vlan2
nameif External
security-level 0
ip address dhcp setroute
regex BlockFacebook "facebook.com"
banner login This is a monitored system. Unauthorized access is prohibited.
boot system disk0:/asa911-k8.bin
ftp mode passive
clock timezone PST -8
clock summer-time PDT recurring
dns domain-lookup Internal
dns domain-lookup External
dns server-group DefaultDNS
name-server 10.0.1.11
name-server 75.153.176.1
name-server 75.153.176.9
domain-name ingo.local
object network obj_any
subnet 0.0.0.0 0.0.0.0
object network LAN-10-0-1-x
subnet 10.0.1.0 255.255.255.0
object network Company-IP1
host xxx.xxx.xxx.xxx
object network Company-IP2
host xxx.xxx.xxx.xxx
object network HYPER-V-DUAL-IP
range 10.0.1.1 10.0.1.2
object network LAN-10-0-1-X
access-list 100 extended permit tcp any4 object HYPER-V-DUAL-IP eq 3389 inactive
access-list 100 extended permit tcp object Company-IP1 object HYPER-V-DUAL-IP eq 3389
access-list 100 extended permit tcp object Company-IP2 object HYPER-V-DUAL-IP eq 3389
tcp-map Normalizer
check-retransmission
checksum-verification
no pager
logging enable
logging timestamp
logging list Threats message 106023
logging list Threats message 106100
logging list Threats message 106015
logging list Threats message 106021
logging list Threats message 401004
logging buffered errors
logging trap Threats
logging asdm debugging
logging device-id hostname
logging host Internal 10.0.1.11 format emblem
logging ftp-bufferwrap
logging ftp-server 10.0.1.11 / asa *****
logging permit-hostdown
mtu Internal 1500
mtu External 1500
ip verify reverse-path interface Internal
ip verify reverse-path interface External
icmp unreachable rate-limit 1 burst-size 1
icmp deny any echo External
asdm image disk0:/asdm-711.bin
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
object network obj_any
nat (Internal,External) dynamic interface
object network LAN-10-0-1-x
nat (Internal,External) dynamic interface
object network HYPER-V-DUAL-IP
nat (Internal,External) static interface service tcp 3389 3389
access-group 100 in interface External
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
aaa-server radius protocol radius
aaa-server radius (Internal) host 10.0.1.11
key *****
radius-common-pw *****
user-identity default-domain LOCAL
aaa authentication ssh console radius LOCAL
http server enable
http LAN-10-0-1-x 255.255.255.0 Internal
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec ikev2 ipsec-proposal DES
protocol esp encryption des
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal 3DES
protocol esp encryption 3des
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES
protocol esp encryption aes
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES192
protocol esp encryption aes-192
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES256
protocol esp encryption aes-256
protocol esp integrity sha-1 md5
crypto ipsec security-association pmtu-aging infinite
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
crypto map External_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map External_map interface External
crypto ca trustpoint srv01_trustpoint
enrollment terminal
crl configure
crypto ca trustpoint asa_cert_trustpoint
keypair asa_cert_trustpoint
crl configure
crypto ca trustpoint LOCAL-CA-SERVER
keypair LOCAL-CA-SERVER
crl configure
crypto ca trustpool policy
crypto ca server
cdp-url http://.../+CSCOCA+/asa_ca.crl:44435
issuer-name CN=...
database path disk0:/LOCAL_CA_SERVER/
smtp from-address ...
publish-crl External 44436
crypto ca certificate chain srv01_trustpoint
certificate <output omitted>
quit
crypto ca certificate chain asa_cert_trustpoint
certificate <output omitted>
quit
crypto ca certificate chain LOCAL-CA-SERVER
certificate <output omitted>
quit
crypto ikev2 policy 1
encryption aes-256
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 10
encryption aes-192
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 20
encryption aes
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 30
encryption 3des
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 40
encryption des
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 enable External client-services port 44455
crypto ikev2 remote-access trustpoint asa_cert_trustpoint
telnet timeout 5
ssh LAN-10-0-1-x 255.255.255.0 Internal
ssh xxx.xxx.xxx.xxx 255.255.255.255 External
ssh xxx.xxx.xxx.xxx 255.255.255.255 External
ssh timeout 5
ssh version 2
console timeout 0
no vpn-addr-assign aaa
no ipv6-vpn-addr-assign aaa
no ipv6-vpn-addr-assign local
dhcpd dns 75.153.176.9 75.153.176.1
dhcpd domain ingo.local
dhcpd option 3 ip 10.0.1.254
dhcpd address 10.0.1.50-10.0.1.81 Internal
dhcpd enable Internal
threat-detection basic-threat
threat-detection scanning-threat shun except ip-address LAN-10-0-1-x 255.255.255.0
threat-detection statistics access-list
threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
dynamic-filter use-database
dynamic-filter enable interface Internal
dynamic-filter enable interface External
dynamic-filter drop blacklist interface Internal
dynamic-filter drop blacklist interface External
ntp server 128.233.3.101 source External
ntp server 128.233.3.100 source External prefer
ntp server 204.152.184.72 source External
ntp server 192.6.38.127 source External
ssl encryption aes256-sha1 aes128-sha1 3des-sha1
ssl trust-point asa_cert_trustpoint External
webvpn
port 44433
enable External
dtls port 44433
anyconnect image disk0:/anyconnect-win-3.1.02026-k9.pkg 1
anyconnect profiles profile1 disk0:/profile1.xml
anyconnect enable
smart-tunnel list SmartTunnelList1 mstsc mstsc.exe platform windows
smart-tunnel list SmartTunnelList1 putty putty.exe platform windows
group-policy DfltGrpPolicy attributes
vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec ssl-client ssl-clientless
webvpn
anyconnect profiles value profile1 type user
username write.ingo password ... encrypted
username ingo password ... encrypted privilege 15
username tom.tucker password ... encrypted
class-map TCP
match port tcp range 1 65535
class-map type regex match-any BlockFacebook
match regex BlockFacebook
class-map type inspect http match-all BlockDomains
match request header host regex class BlockFacebook
class-map inspection_default
match default-inspection-traffic
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 1500
id-randomization
policy-map TCP
class TCP
set connection conn-max 1000 embryonic-conn-max 1000 per-client-max 250 per-client-embryonic-max 250
set connection timeout dcd
set connection advanced-options Normalizer
set connection decrement-ttl
policy-map type inspect http HTTP
parameters
protocol-violation action drop-connection log
class BlockDomains
policy-map global_policy
class inspection_default
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
inspect dns preset_dns_map dynamic-filter-snoop
inspect http HTTP
service-policy global_policy global
service-policy TCP interface External
smtp-server 199.185.220.249
privilege cmd level 3 mode exec command perfmon
privilege cmd level 3 mode exec command ping
privilege cmd level 3 mode exec command who
privilege cmd level 3 mode exec command logging
privilege cmd level 3 mode exec command failover
privilege cmd level 3 mode exec command vpn-sessiondb
privilege cmd level 3 mode exec command packet-tracer
privilege show level 5 mode exec command import
privilege show level 5 mode exec command running-config
privilege show level 3 mode exec command reload
privilege show level 3 mode exec command mode
privilege show level 3 mode exec command firewall
privilege show level 3 mode exec command asp
privilege show level 3 mode exec command cpu
privilege show level 3 mode exec command interface
privilege show level 3 mode exec command clock
privilege show level 3 mode exec command dns-hosts
privilege show level 3 mode exec command access-list
privilege show level 3 mode exec command logging
privilege show level 3 mode exec command vlan
privilege show level 3 mode exec command ip
privilege show level 3 mode exec command failover
privilege show level 3 mode exec command asdm
privilege show level 3 mode exec command arp
privilege show level 3 mode exec command ipv6
privilege show level 3 mode exec command route
privilege show level 3 mode exec command ospf
privilege show level 3 mode exec command aaa-server
privilege show level 3 mode exec command aaa
privilege show level 3 mode exec command eigrp
privilege show level 3 mode exec command crypto
privilege show level 3 mode exec command ssh
privilege show level 3 mode exec command vpn-sessiondb
privilege show level 3 mode exec command vpnclient
privilege show level 3 mode exec command vpn
privilege show level 3 mode exec command dhcpd
privilege show level 3 mode exec command blocks
privilege show level 3 mode exec command wccp
privilege show level 3 mode exec command dynamic-filter
privilege show level 3 mode exec command webvpn
privilege show level 3 mode exec command service-policy
privilege show level 3 mode exec command module
privilege show level 3 mode exec command uauth
privilege show level 3 mode exec command compression
privilege show level 3 mode configure command interface
privilege show level 3 mode configure command clock
privilege show level 3 mode configure command access-list
privilege show level 3 mode configure command logging
privilege show level 3 mode configure command ip
privilege show level 3 mode configure command failover
privilege show level 5 mode configure command asdm
privilege show level 3 mode configure command arp
privilege show level 3 mode configure command route
privilege show level 3 mode configure command aaa-server
privilege show level 3 mode configure command aaa
privilege show level 3 mode configure command crypto
privilege show level 3 mode configure command ssh
privilege show level 3 mode configure command dhcpd
privilege show level 5 mode configure command privilege
privilege clear level 3 mode exec command dns-hosts
privilege clear level 3 mode exec command logging
privilege clear level 3 mode exec command arp
privilege clear level 3 mode exec command aaa-server
privilege clear level 3 mode exec command crypto
privilege clear level 3 mode exec command dynamic-filter
privilege cmd level 3 mode configure command failover
privilege clear level 3 mode configure command logging
privilege clear level 3 mode configure command arp
privilege clear level 3 mode configure command crypto
privilege clear level 3 mode configure command aaa-server
prompt hostname context
no call-home reporting anonymous
call-home
profile CiscoTAC-1
no active
destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
destination address email [email protected]
destination transport-method http
subscribe-to-alert-group diagnostic
subscribe-to-alert-group environment
subscribe-to-alert-group inventory periodic monthly
subscribe-to-alert-group configuration periodic monthly
subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:41a021a28f73c647a2f550ba932bed1a
: end
Many thanks,
Ingo

Hi Jose,
here is what I got now:
ASA(config)# sh run | begin tunnel-group
tunnel-group DefaultWEBVPNGroup general-attributes
address-pool VPNPool
authorization-required
and DAP debugging still the same:
ASA(config)# DAP_TRACE: DAP_open: CDC45080
DAP_TRACE: Username: tom.tucker, aaa.cisco.grouppolicy = DfltGrpPolicy
DAP_TRACE: Username: tom.tucker, aaa.cisco.username = tom.tucker
DAP_TRACE: Username: tom.tucker, aaa.cisco.username1 = tom.tucker
DAP_TRACE: Username: tom.tucker, aaa.cisco.username2 =
DAP_TRACE: Username: tom.tucker, aaa.cisco.tunnelgroup = DefaultWEBVPNGroup
DAP_TRACE: Username: tom.tucker, DAP_add_SCEP: scep required = [FALSE]
DAP_TRACE: Username: tom.tucker, DAP_add_AC:
endpoint.anyconnect.clientversion="3.1.02026";
endpoint.anyconnect.platform="win";
DAP_TRACE: Username: tom.tucker, dap_aggregate_attr: rec_count = 1
DAP_TRACE: Username: tom.tucker, Selected DAPs: DfltAccessPolicy
DAP_TRACE: Username: tom.tucker, DAP_close: CDC45080
Unfortunately, it still doesn't work. Hmmm.. maybe a wipe of the config and starting from scratch can help?
Thanks,
Ingo

AnyConnect client 3.1.04063 Windows 7 x64 users cannot make ssl connection

Similar Messages

Maybe you are looking for