Anyconnect CLIENT configuration issues

Hi all,
OK, Does anybody know of any documentation or has any knowledge on how to configure the AnyConnect CLIENT so that I can change the authentication method from RSA to RADIUS.
Now, I can do all of the work required on the ASA, and this is where everything goes south.
Example:-
AC client connects to ASA - profile says use RSA - user get prompted for username / passcode. - so far so good.
Change ASA to use RADIUS from RSA - save config.
AC Client connects to ASA - Nothing - as Client is configured to use RSA BUT ASA is listening for a RADIUS request - as this can be seen in the logging.
Anyone any ideas as to where I'm going wrong.
Further to this, I have tried to create a blank xml profile, trawled the forums (as best I can) but not seen anything that gives me the answer.
Stephen

Hi Stephen,
After changing the authentication to Radius server  , I hope you have changed the connection profile to use the correct authentication server.
Please share the relevant configuration from ASA including connection profile and group-policy that the user connects and the AAA server configuration on ASA.
Regards,
Dinesh Moudgil
P.S Please rate helpful posts.

Similar Messages

  • WSUS server and client configuration issues

    I just inherited WSUS from my predecessor (it was turned off because of a full disk) so I’m still learning how to use it. Turning it back on I changed where updates should come from, they were stored locally and now I’m pulling them down off of the Microsoft
    Update location. What I’m seeing is that I have a bunch of computers that WSUS “sees” but are showing “Failed or Needed” status. Unless I visit each machine and manually do the updates this status does not change. Additionally I have some client computers
    (Windows 7) that are not showing up as managed by WSUS. If I reading this right I’m running version Update Services 6.2.9200.16384 on Management Console 3.0 Version 6.2 (build 9200) on Windows Server 2012.
    How can I force WSUS to automatically update the “Failed and Needed” devices?
    How can I get those clients that are not being managed by WSUS to be managed?
    Some of the things that I have done so far on the server and clients are:
    Create a GPO (see attached for WSUS)
    wuauclt
    /detectnow
    wuauclt /reportnow
    wuauclt.exe /detectnow
    gpupdate /force after
    modifying the GPO
    I even ran the SolarWinds WSUS diagnostic (as a non-administrator) and got this as the output:
    # Solarwinds® Diagnostic Tool for the WSUS Agent # 1/23/2015
    Machine state
      User rights:  User does not have administrative rights (Administrator rights are not available)
      Update service status:  Running
      Background Intelligent Transfer service status:   
    Running
      OS Version:  Windows 8.1 Pro
      Windows update agent version:   7.9.9600.17489 (WU Agent is OK)
    Windows Update Agent configuration settings
      Automatic Update:    Enabled
      Options:  Automatically download and notify of installation
      Use WSUS Server: Not found (There is no such key)
      Windows Update Server:  Not found (There is no such key)
      Windows Update Status Server:  Not found (There is no such key)
      WSUS URLs are identical:  Values are empty
    WSUS Server Connectivity -- Connectivity check is impossible
    So, my questions are:
    What tool do I use to configure the client machine?
    How do I get WSUS to update my clients?
    Thanks
    Sam

    Steven,
    I'm pretty sure that this is not the right forum to discuss this in but just so we can close this case.
    On my computer I ran the command gpupdate /force I
    then rebooted my computer to make sure that the group policy would be updated. The first screen shot is from my domain controller and the second is from my computer. As you can see the Domain Controller has the correct settings but the local machine doesn't.
    Other parts of the DC GPO settings have worked so I'm somewhat comfortable that it is being propagated properly.

  • AnyConnect Client Profile Backup Server Configuration

    I'm trying to understand the use of Backup Server option in AnyConnect Client Profile
    Configuration > Remote Access VPN > Network (Client) Access > AnyConnect Client Profile > Edit > Backup Server
    (Screenshot attached)
    My questions:
    1. In what all scenarios do we add servers (ASA devices) in this tab
    2. If I have same information in two different locations (Site A and Site B) for AnyConnect user, can I add Site A-ASA and Site B-ASA into Backup Server tab as a failover mechanism for end user.
    3. Or is it only used to mention ASA devices configured in failover unit
    4. In case of failover unit, does it support stateful failover
    I could not find answers to above questions from Google search. So, asking here

    I think we need to be careful when we talk about failover. The original post was clearly asking about two different scenarios
    1) ASAs at two different sites
    2) ASAs configured as a High Availability failover pair (Active/Standby).
    The profile does work to provide failover in 1) but does not work to provide failover in 2).
    I do not know the authoritative answer to the question about IP phones use of the profile. I believe that the answer ought to be that yes the phone would receive the profile after its first connection and would use the backup server identified in the profile is the primary server was not available. That is a basic functionality of the AnyConnect client and if the phone is using the AnyConnect client then it ought to support that failover. 
    If someone does have an authoritative answer then please speak up. Several of us would like to know the right answer here.
    HTH
    Rick

  • AnyConnect Secure Mobility Client Connection Issue

    Hello all,
    I am specifically having issue of unable to connect do VPN using AnyConnect Secure Mobility Client. This issue is only happening on my Windows7 machine. All of this use to work before properly without any issue. All of sudden now I am getting below error when I initiate the AnyConnect client from last few days. The errors are as below in sequence:
    1) Posture Assessment Failed: Hotscan prelogin error
    2) An Error has occured while running HotScan. Please attempt to connect again
    Message HIstory shows below:
    Wed Feb 05 00:34:28 2014] Posture Assessment: Required for access
    [Wed Feb 05 00:34:28 2014] Posture Assessment: Checking for updates...
    [Wed Feb 05 00:34:30 2014] Posture Assessment: Updating...
    [Wed Feb 05 00:34:32 2014] Posture Assessment: Initiating...
    [Wed Feb 05 00:34:37 2014] Posture Assessment: Failed
    Wed Feb 05 00:34:28 2014] Posture Assessment: Required for access
    [Wed Feb 05 00:34:28 2014] Posture Assessment: Checking for updates...
    [Wed Feb 05 00:34:30 2014] Posture Assessment: Updating...
    [Wed Feb 05 00:34:32 2014] Posture Assessment: Initiating...
    [Wed Feb 05 00:34:37 2014] Posture Assessment: Failed
    Any idea whats causing this issue on my machine?
    Thanks,
    bws

    What are the prelogin checks specified in your dap.xml file? Verify your client meets those checks.

  • Issue with client configuration for CuciLync 9.2.5

    Hi,
    we are currently preparing the client configuration for CuciLync 9.2.5.
    When CuciLync starts we don't want to see the CuciLync window in the foreground.
    Therefore we use the 'hubvisible' setting.
    %APPDATA% \Cisco\Unified Communications\Jabber\CSF\Config\jabberLocalConfig.xml
    <userConfig name="hubvisible" value="FALSE"/>
    In addition we use this setting in the file
    ProgramFiles%\Cisco Systems\CUCILync\jabber-config-defaults.xml
    At first it looks like that the setting works fine.
    But CuciLync always resets 'hubvisible' to 'true'.
    Any idea what needs to be done to ensure that the setting is not overwritten ?
    Thanks in advance for your feedback
    Best Regards
    Carsten Lucy

    that might help
    http://mysite.voicebootcamp.com/index.php/free-video-labs/video/uc-collaboration-ccie-collaboration-chapter-4-1-voice-gatew

  • Anyconnect client issue

    Is there any reason that the connection settings don't save in the anyconnect client? When the users first connect to the website to get the anyconnect client they are fine. Also if they reconnect by going to the website they are fine. But if they just try to connect through the client itself (without going to the website) they have to retype the connection name. Is there a way to fix this? Any help would be appreciated. Thank you!

    WebLaunch mode-Lets the user enter the URL of the security appliance in the Address or Location field of a browser using the https protocol. The user then enters the username and password information on a Logon screen and selects the group and clicks submit. If you have specified a banner, that information appears, and the user acknowledges the banner by clicking Continue.

  • AnyConnect error " User not authorized for AnyConnect Client access, contact your administrator"

    Hi everyone,
    it's probably just me but I have tried real hard to get a simple AnyConnect setup working in a lab environment on my ASA 5505 at home, without luck. When I connect with the AnyConnect client I get the error message "User not authorized for AnyConnect Client access, contact your administrator". I have searched for this error and tried some of the few solutions out there, but to no avail. I also updated the ASA from 8.4.4(1) to 9.1(1) and ASDM from 6.4(9) to 7.1(1) but still the same problem. The setup of the ASA is straight forward, directly connected to the Internet with a 10.0.1.0 / 24 subnet on the inside and an address pool of 10.0.2.0 / 24 to assign to the VPN clients. Please note that due to ISP restrictions, I'm using port 44455 instead of 443. I had AnyConnect working with the SSL portal, but IKEv2 IPsec is giving me a headache. I have stripped down certificate authentication which I had running before just to eliminate this as a potential cause of the issue. When running debugging, I do not get any error messages - the handshake completes successfully and the local authentication works fine as well.
    Please find the current config and debugging output below. I appreciate any pointers as to what might be wrong here.
    : Saved
    ASA Version 9.1(1)
    hostname ASA
    domain-name ingo.local
    enable password ... encrypted
    xlate per-session deny tcp any4 any4
    xlate per-session deny tcp any4 any6
    xlate per-session deny tcp any6 any4
    xlate per-session deny tcp any6 any6
    xlate per-session deny udp any4 any4 eq domain
    xlate per-session deny udp any4 any6 eq domain
    xlate per-session deny udp any6 any4 eq domain
    xlate per-session deny udp any6 any6 eq domain
    passwd ... encrypted
    names
    name 10.0.1.0 LAN-10-0-1-x
    dns-guard
    ip local pool VPNPool 10.0.2.1-10.0.2.10 mask 255.255.255.0
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
    nameif Internal
    security-level 100
    ip address 10.0.1.254 255.255.255.0
    interface Vlan2
    nameif External
    security-level 0
    ip address dhcp setroute
    regex BlockFacebook "facebook.com"
    banner login This is a monitored system. Unauthorized access is prohibited.
    boot system disk0:/asa911-k8.bin
    ftp mode passive
    clock timezone PST -8
    clock summer-time PDT recurring
    dns domain-lookup Internal
    dns domain-lookup External
    dns server-group DefaultDNS
    name-server 10.0.1.11
    name-server 75.153.176.1
    name-server 75.153.176.9
    domain-name ingo.local
    object network obj_any
    subnet 0.0.0.0 0.0.0.0
    object network LAN-10-0-1-x
    subnet 10.0.1.0 255.255.255.0
    object network Company-IP1
    host xxx.xxx.xxx.xxx
    object network Company-IP2
    host xxx.xxx.xxx.xxx
    object network HYPER-V-DUAL-IP
    range 10.0.1.1 10.0.1.2
    object network LAN-10-0-1-X
    access-list 100 extended permit tcp any4 object HYPER-V-DUAL-IP eq 3389 inactive
    access-list 100 extended permit tcp object Company-IP1 object HYPER-V-DUAL-IP eq 3389
    access-list 100 extended permit tcp object Company-IP2 object HYPER-V-DUAL-IP eq 3389 
    tcp-map Normalizer
      check-retransmission
      checksum-verification
    no pager
    logging enable
    logging timestamp
    logging list Threats message 106023
    logging list Threats message 106100
    logging list Threats message 106015
    logging list Threats message 106021
    logging list Threats message 401004
    logging buffered errors
    logging trap Threats
    logging asdm debugging
    logging device-id hostname
    logging host Internal 10.0.1.11 format emblem
    logging ftp-bufferwrap
    logging ftp-server 10.0.1.11 / asa *****
    logging permit-hostdown
    mtu Internal 1500
    mtu External 1500
    ip verify reverse-path interface Internal
    ip verify reverse-path interface External
    icmp unreachable rate-limit 1 burst-size 1
    icmp deny any echo External
    asdm image disk0:/asdm-711.bin
    no asdm history enable
    arp timeout 14400
    no arp permit-nonconnected
    object network obj_any
    nat (Internal,External) dynamic interface
    object network LAN-10-0-1-x
    nat (Internal,External) dynamic interface
    object network HYPER-V-DUAL-IP
    nat (Internal,External) static interface service tcp 3389 3389
    access-group 100 in interface External
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    aaa-server radius protocol radius
    aaa-server radius (Internal) host 10.0.1.11
    key *****
    radius-common-pw *****
    user-identity default-domain LOCAL
    aaa authentication ssh console radius LOCAL
    http server enable
    http LAN-10-0-1-x 255.255.255.0 Internal
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec ikev2 ipsec-proposal DES
    protocol esp encryption des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal 3DES
    protocol esp encryption 3des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES
    protocol esp encryption aes
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES192
    protocol esp encryption aes-192
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES256
    protocol esp encryption aes-256
    protocol esp integrity sha-1 md5
    crypto ipsec security-association pmtu-aging infinite
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
    crypto map External_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map External_map interface External
    crypto ca trustpoint srv01_trustpoint
    enrollment terminal
    crl configure
    crypto ca trustpoint asa_cert_trustpoint
    keypair asa_cert_trustpoint
    crl configure
    crypto ca trustpoint LOCAL-CA-SERVER
    keypair LOCAL-CA-SERVER
    crl configure
    crypto ca trustpool policy
    crypto ca server
    cdp-url http://.../+CSCOCA+/asa_ca.crl:44435
    issuer-name CN=...
    database path disk0:/LOCAL_CA_SERVER/
    smtp from-address ...
    publish-crl External 44436
    crypto ca certificate chain srv01_trustpoint
    certificate <output omitted>
      quit
    crypto ca certificate chain asa_cert_trustpoint
    certificate <output omitted>
      quit
    crypto ca certificate chain LOCAL-CA-SERVER
    certificate <output omitted>
      quit
    crypto ikev2 policy 1
    encryption aes-256
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 10
    encryption aes-192
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 20
    encryption aes
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 30
    encryption 3des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 40
    encryption des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 enable External client-services port 44455
    crypto ikev2 remote-access trustpoint asa_cert_trustpoint
    telnet timeout 5
    ssh LAN-10-0-1-x 255.255.255.0 Internal
    ssh xxx.xxx.xxx.xxx 255.255.255.255 External
    ssh xxx.xxx.xxx.xxx 255.255.255.255 External
    ssh timeout 5
    ssh version 2
    console timeout 0
    no vpn-addr-assign aaa
    no ipv6-vpn-addr-assign aaa
    no ipv6-vpn-addr-assign local
    dhcpd dns 75.153.176.9 75.153.176.1
    dhcpd domain ingo.local
    dhcpd option 3 ip 10.0.1.254
    dhcpd address 10.0.1.50-10.0.1.81 Internal
    dhcpd enable Internal
    threat-detection basic-threat
    threat-detection scanning-threat shun except ip-address LAN-10-0-1-x 255.255.255.0
    threat-detection statistics access-list
    threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
    dynamic-filter use-database
    dynamic-filter enable interface Internal
    dynamic-filter enable interface External
    dynamic-filter drop blacklist interface Internal
    dynamic-filter drop blacklist interface External
    ntp server 128.233.3.101 source External
    ntp server 128.233.3.100 source External prefer
    ntp server 204.152.184.72 source External
    ntp server 192.6.38.127 source External
    ssl encryption aes256-sha1 aes128-sha1 3des-sha1
    ssl trust-point asa_cert_trustpoint External
    webvpn
    port 44433
    enable External
    dtls port 44433
    anyconnect image disk0:/anyconnect-win-3.1.02026-k9.pkg 1
    anyconnect profiles profile1 disk0:/profile1.xml
    anyconnect enable
    smart-tunnel list SmartTunnelList1 mstsc mstsc.exe platform windows
    smart-tunnel list SmartTunnelList1 putty putty.exe platform windows
    group-policy DfltGrpPolicy attributes
    vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec ssl-client ssl-clientless
    webvpn
      anyconnect profiles value profile1 type user
    username write.ingo password ... encrypted
    username ingo password ... encrypted privilege 15
    username tom.tucker password ... encrypted
    class-map TCP
    match port tcp range 1 65535
    class-map type regex match-any BlockFacebook
    match regex BlockFacebook
    class-map type inspect http match-all BlockDomains
    match request header host regex class BlockFacebook
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 1500
      id-randomization
    policy-map TCP
    class TCP
      set connection conn-max 1000 embryonic-conn-max 1000 per-client-max 250 per-client-embryonic-max 250
      set connection timeout dcd
      set connection advanced-options Normalizer
      set connection decrement-ttl
    policy-map type inspect http HTTP
    parameters
      protocol-violation action drop-connection log
    class BlockDomains
    policy-map global_policy
    class inspection_default
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny 
      inspect sunrpc
      inspect xdmcp
      inspect sip 
      inspect netbios
      inspect tftp
      inspect ip-options
      inspect dns preset_dns_map dynamic-filter-snoop
      inspect http HTTP
    service-policy global_policy global
    service-policy TCP interface External
    smtp-server 199.185.220.249
    privilege cmd level 3 mode exec command perfmon
    privilege cmd level 3 mode exec command ping
    privilege cmd level 3 mode exec command who
    privilege cmd level 3 mode exec command logging
    privilege cmd level 3 mode exec command failover
    privilege cmd level 3 mode exec command vpn-sessiondb
    privilege cmd level 3 mode exec command packet-tracer
    privilege show level 5 mode exec command import
    privilege show level 5 mode exec command running-config
    privilege show level 3 mode exec command reload
    privilege show level 3 mode exec command mode
    privilege show level 3 mode exec command firewall
    privilege show level 3 mode exec command asp
    privilege show level 3 mode exec command cpu
    privilege show level 3 mode exec command interface
    privilege show level 3 mode exec command clock
    privilege show level 3 mode exec command dns-hosts
    privilege show level 3 mode exec command access-list
    privilege show level 3 mode exec command logging
    privilege show level 3 mode exec command vlan
    privilege show level 3 mode exec command ip
    privilege show level 3 mode exec command failover
    privilege show level 3 mode exec command asdm
    privilege show level 3 mode exec command arp
    privilege show level 3 mode exec command ipv6
    privilege show level 3 mode exec command route
    privilege show level 3 mode exec command ospf
    privilege show level 3 mode exec command aaa-server
    privilege show level 3 mode exec command aaa
    privilege show level 3 mode exec command eigrp
    privilege show level 3 mode exec command crypto
    privilege show level 3 mode exec command ssh
    privilege show level 3 mode exec command vpn-sessiondb
    privilege show level 3 mode exec command vpnclient
    privilege show level 3 mode exec command vpn
    privilege show level 3 mode exec command dhcpd
    privilege show level 3 mode exec command blocks
    privilege show level 3 mode exec command wccp
    privilege show level 3 mode exec command dynamic-filter
    privilege show level 3 mode exec command webvpn
    privilege show level 3 mode exec command service-policy
    privilege show level 3 mode exec command module
    privilege show level 3 mode exec command uauth
    privilege show level 3 mode exec command compression
    privilege show level 3 mode configure command interface
    privilege show level 3 mode configure command clock
    privilege show level 3 mode configure command access-list
    privilege show level 3 mode configure command logging
    privilege show level 3 mode configure command ip
    privilege show level 3 mode configure command failover
    privilege show level 5 mode configure command asdm
    privilege show level 3 mode configure command arp
    privilege show level 3 mode configure command route
    privilege show level 3 mode configure command aaa-server
    privilege show level 3 mode configure command aaa
    privilege show level 3 mode configure command crypto
    privilege show level 3 mode configure command ssh
    privilege show level 3 mode configure command dhcpd
    privilege show level 5 mode configure command privilege
    privilege clear level 3 mode exec command dns-hosts
    privilege clear level 3 mode exec command logging
    privilege clear level 3 mode exec command arp
    privilege clear level 3 mode exec command aaa-server
    privilege clear level 3 mode exec command crypto
    privilege clear level 3 mode exec command dynamic-filter
    privilege cmd level 3 mode configure command failover
    privilege clear level 3 mode configure command logging
    privilege clear level 3 mode configure command arp
    privilege clear level 3 mode configure command crypto
    privilege clear level 3 mode configure command aaa-server
    prompt hostname context
    no call-home reporting anonymous
    call-home
    profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:41a021a28f73c647a2f550ba932bed1a
    : end
    Many thanks,
    Ingo

    Hi Jose,
    here is what I got now:
    ASA(config)# sh run | begin tunnel-group
    tunnel-group DefaultWEBVPNGroup general-attributes
    address-pool VPNPool
    authorization-required
    and DAP debugging still the same:
    ASA(config)# DAP_TRACE: DAP_open: CDC45080
    DAP_TRACE: Username: tom.tucker, aaa.cisco.grouppolicy = DfltGrpPolicy
    DAP_TRACE: Username: tom.tucker, aaa.cisco.username = tom.tucker
    DAP_TRACE: Username: tom.tucker, aaa.cisco.username1 = tom.tucker
    DAP_TRACE: Username: tom.tucker, aaa.cisco.username2 =
    DAP_TRACE: Username: tom.tucker, aaa.cisco.tunnelgroup = DefaultWEBVPNGroup
    DAP_TRACE: Username: tom.tucker, DAP_add_SCEP: scep required = [FALSE]
    DAP_TRACE: Username: tom.tucker, DAP_add_AC:
    endpoint.anyconnect.clientversion="3.1.02026";
    endpoint.anyconnect.platform="win";
    DAP_TRACE: Username: tom.tucker, dap_aggregate_attr: rec_count = 1
    DAP_TRACE: Username: tom.tucker, Selected DAPs: DfltAccessPolicy
    DAP_TRACE: Username: tom.tucker, DAP_close: CDC45080
    Unfortunately, it still doesn't work. Hmmm.. maybe a wipe of the config and starting from scratch can help?
    Thanks,
    Ingo

  • AnyConnect client reconnects after 1 minute

    AnyConnect client reconnects after 1 minute; WHY
    version 3.1.02026
    ASA:asa911-k8.bin
    [25-4-2013 8:16:11] Establishing VPN session...
    [25-4-2013 8:16:11] Checking for profile updates...
    [25-4-2013 8:16:11] Checking for product updates...
    [25-4-2013 8:16:11] Checking for customization updates...
    [25-4-2013 8:16:11] Performing any required updates...
    [25-4-2013 8:16:12] Establishing VPN session...
    [25-4-2013 8:16:12] Establishing VPN - Initiating connection...
    [25-4-2013 8:16:12] Establishing VPN - Examining system...
    [25-4-2013 8:16:12] Establishing VPN - Activating VPN adapter...
    [25-4-2013 8:16:15] Establishing VPN - Configuring system...
    [25-4-2013 8:16:16] Establishing VPN...
    [25-4-2013 8:16:16] Connected to my.vpn.com.
    [25-4-2013 8:16:16] Connected to my.vpn.com.
    [25-4-2013 8:17:19] Reconnecting to my.vpn.com...
    [25-4-2013 8:17:19] Establishing VPN - Examining system...
    [25-4-2013 8:17:24] Establishing VPN - Activating VPN adapter...
    [25-4-2013 8:17:25] Establishing VPN - Configuring system...
    [25-4-2013 8:17:25] Establishing VPN...
    [25-4-2013 8:17:25] Connected to my.vpn.com.
    [25-4-2013 8:17:25] Reconnecting to my.vpn.com...
    [25-4-2013 8:17:25] Establishing VPN - Examining system...
    [25-4-2013 8:17:25] Establishing VPN - Activating VPN adapter...
    [25-4-2013 8:17:25] Establishing VPN - Configuring system...
    [25-4-2013 8:17:25] Establishing VPN...
    [25-4-2013 8:17:25] Connected to my.vpn.com.
    [25-4-2013 8:16:11] Establishing VPN session...
    [25-4-2013 8:16:11] Checking for profile updates...
    [25-4-2013 8:16:11] Checking for product updates...
    [25-4-2013 8:16:11] Checking for customization updates...
    [25-4-2013 8:16:11] Performing any required updates...
    [25-4-2013 8:16:12] Establishing VPN session...
    [25-4-2013 8:16:12] Establishing VPN - Initiating connection...
    [25-4-2013 8:16:12] Establishing VPN - Examining system...
    [25-4-2013 8:16:12] Establishing VPN - Activating VPN adapter...
    [25-4-2013 8:16:15] Establishing VPN - Configuring system...
    [25-4-2013 8:16:16] Establishing VPN...
    [25-4-2013 8:16:16] Connected to my.vpn.com.
    [25-4-2013 8:16:16] Connected to my.vpn.com.
    [25-4-2013 8:17:19] Reconnecting to my.vpn.com...
    [25-4-2013 8:17:19] Establishing VPN - Examining system...
    [25-4-2013 8:17:24] Establishing VPN - Activating VPN adapter...
    [25-4-2013 8:17:25] Establishing VPN - Configuring system...
    [25-4-2013 8:17:25] Establishing VPN...
    [25-4-2013 8:17:25] Connected to my.vpn.com.
    [25-4-2013 8:17:25] Reconnecting to my.vpn.com...
    [25-4-2013 8:17:25] Establishing VPN - Examining system...
    [25-4-2013 8:17:25] Establishing VPN - Activating VPN adapter...
    [25-4-2013 8:17:25] Establishing VPN - Configuring system...
    [25-4-2013 8:17:25] Establishing VPN...
    [25-4-2013 8:17:25] Connected to my.vpn.com.

    Hello Michael,
    The problem here is because we cannot succesfully establish a DTLS tunnel. This could happen because:
    - DTLS is blocked somewhere in the path
    - A non-default DTLS port is being used
    If DTLS is blocked in the middle the issue is because as of ASA Release 9.x and AnyConnect Release 3.x, an optimization has been introduced in the form of distinct Maximum Transition Units (MTUs) that are negotiated for TLS/DTLS between the client/ASA. Previously, the client derived a rough estimate MTU which covered both TLS/DTLS and was obviously less than optimal. Now, the ASA computes the encapsulation overhead for both TLS/DTLS and derives the MTU values accordingly.
    As long as DTLS is enabled, the client applies the DTLS MTU (in this case 1418) on the VPN adapter (which is enabled before the DTLS tunnel is established and is needed for routes/filters enforcement), to ensure optimum performance. If the DTLS tunnel cannot be established or it is dropped at some point, the client fails over to TLS and adjusts the MTU on the virtual adapter (VA) to the TLS MTU value (this requires a session level reconnect).
    In order to eliminate this visible transition of DTLS > TLS,  you can configure a separate tunnel group for TLS only access for users that have trouble with the establishment of the DTLS tunnel (such as due to firewall restrictions).
    1. The best option is to set the AnyConnect MTU value to be lower than the TLS MTU, which is then negotiated.
    group-policy ac_users_group attributes
    webvpn
      anyconnect mtu 1300
    This makes TLS and DTLS MTU values equal. Reconnections are not seen in this case.
    2. The second option is to allow fragmentation.
    group-policy ac_users_group attributes
    webvpn
      anyconnect ssl df-bit-ignore enable
    With fragmentation, large packets (whose size exceeds the MTU value) can be fragmented and sent through the TLS tunnel.
    3. The third option is to set the Maximum Segment Size (MSS) to 1460 as follows:
    sysopt conn tcpmss 1460
    In this case, the TLS MTU will be 1427 (RC4/SHA1) which is larger than the DTLS MTU 1418 (AES/SHA1/LZS). This should resolve the issue with TCP from the ASA to the AnyConnect client (thanks to MSS), but large UDP traffic from the ASA to the AnyConnect client might suffer from this as it will be dropped by the AnyConnect client due to the lower AnyConnect client MTU 1418. If sysopt conn tcpmss is modified, it might affect other features such as LAN-to-LAN (L2L) IPSec VPN tunnels.
    If DTLS is not blocked in the middle another potential cause for the DTLS failure that DTLS is configured on a non-default port after the WebVPN is enabled (for example, when the webvpn enable outside command is entered). This is due to Cisco bug ID CSCuh61321 and has been seen in Release 9.x where the ASA pushes the non-default port to the client, but continues to listen to the default port. Consequently, the DTLS is not built and AnyConnect reconnects.
    The workaround for this problem is:
    Disable the WebVPN.
    Enter the DTLS port.
    Enable the WebVPN.
    Regards,
    -Gustavo Medina

  • Unable to use proxy server with MAC OS X Anyconnect client

    Hi All,
    I have a VPN setup thru a Cisco 5520, Windows clients connect just find and the end users configure there browser to use our internal proxy servers.   Users with the MAC OS X Anyconnect client can connect, they configure their Mac to use our proxy server, but the broswers will not work, clients can reach networks and resources behind the VPN gateway and have access to the Proxy(Tried a telnet to that hostname/port).  Anyone run into this issue before?  I am running ASA 8.3(2), Anyconnect(OS X) 3.1.01065.
    Thank You

    We had the same problem.
    We are behind government firewall so I don't know which Cisco firewall is used but we are using AnyConnect to establish VPN from internet to LAN behind firewall. We have no problems with Windows. With Mac OS X connection through proxy didn't work with Safari and Chrome (both are using system Proxy setting), but it did work with Firefox (which has it's own Proxy).
    Finally we found out that ethernet MTU size was the culprit. When we set it to manual, with size being 1347 (or less), proxy started to work.

  • AnyConnect clients randomly disconnect, reconnect

    Hello,
    We have been using our current configuration for some time, but recently most of the AnyConnect clients randomly loose connection, then reconnect. I have had the ISP and SonicWall look to see if they find any issue, but they do not. I have checked the event viewer on one XP machine and find numerous log entries regarding connection timeouts, etc. I have listed some below. A search of this comunity resulted in only one response that was incomplete.
    This entry is listed as Error, Event ID 2, source is vpnagent:
    Function: CHttpProbeAsync::OnOpenRequestComplete
    File: .\IP\HttpProbeAsync.cpp
    Line: 254
    Invoked Function: CHttpSessionAsync::OnOpenRequestComplete
    Return Code: -31522780 (0xFE1F0024)
    Description: SOCKETTRANSPORT_ERROR_CONNECT_TIMEOUT
    Another error:
    Function: CNetEnvironment::TestNetEnv
    File: .\NetEnvironment.cpp
    Line: 190
    Invoked Function: CNetEnvironment::testNetwork
    Return Code: -28901363 (0xFE47000D)
    Description: NETENVIRONMENT_ERROR_PROBE_INCOMPLETE:Network Probe could not contact target
    This entry is a Warning:
    Function: CNetEnvironment::logProbeFailure
    File: .\NetEnvironment.cpp
    Line: 1068
    Invoked Function: CHttpProbeAsync::SendProbe
    Return Code: -27787250 (0xFE58000E)
    Description: HTTP_PROBE_ASYNC_ERROR_CANNOT_CONNECT
    HTTP (host: 198.210.1.1)
    Another Warning:
    Reconnect reason code 6:
    Reconnecting due to the disruption of the VPN connection to the secure gateway.
    There are numerous information logs referring to reconnecting, VPN connection re-established, primary SSL connection to the secure gateway is down.
    Anyone have ideas on how to troubleshoot this?
    Thank you for any suggestions.

    Bill,
    Were you able to diagnose why this issue was/is occuring? We are experiencing a similar issue with a user in our organization:
    Session level reconnect reason code 6:
    Disruption of the VPN connection to the secure gateway.
    Originates from tunnel level
    Function: CSslTunnelTransport::OnTransportInitiateComplete
    File: .\SslTunnelTransport.cpp
    Line: 363
    Invoked Function: CTcpTransport::initiateTransport
    Return Code: -31588316 (0xFE1E0024)
    Description: SOCKETTRANSPORT_ERROR_CONNECT_TIMEOUT

  • XE connection problem after using Cisco AnyConnect Client

    Hello
    I have a rather annoying problem connecting to an XE instance AFTER I have disconnected from a VPN via a Cisco AnyConnect VPN Agent.
    Sequence of operations:
    - start Oracle XE and work normally
    - connect to client's vpn
    - do other stuff
    - DISCONNECT from Client's VPN
    -> unable to connect to XE service any more, unless I reboot
    The problem does not happen with other vpn clients like Cisco VPN Service, Juniper, Checkpoint.
    Details:
    - sqlplus connection WITH service name (eg sqlplus user/pwd@XE): FAILURE with ORA-12170
    - but...sqlplus connection WITHOUT service name (eg sqlplus user/pwd): SUCCESS (weird !)
    - tnsping XE: TNS-12535 error
    - lsnrctl status output (sorry, italian localized)
    LSNRCTL for 32-bit Windows: Version 10.2.0.1.0 - Production on 22-GIU-2011 14:19
    :38
    Copyright (c) 1991, 2005, Oracle. All rights reserved.
    Connessione a (DESCRIPTION=(ADDRESS=(PROTOCOL=IPC)(KEY=EXTPROC_FOR_XE)))
    STATO del LISTENER
    Alias LISTENER
    Versione TNSLSNR for 32-bit Windows: Version 10.2.0.1.0 - Produ
    ction
    Data di inizio 22-GIU-2011 12:26:15
    Tempo di attivitÓ 0 giorni 1 ore 53 min. 22 sec.
    Livello trace off
    Sicurezza ON: Local OS Authentication
    SNMP OFF
    Servizio predefinito XE
    File di parametri listenerC:\programs\oraclexe\app\oracle\product\10.2.0\server\
    network\admin\listener.ora
    File di log listener C:\programs\oraclexe\app\oracle\product\10.2.0\server\
    network\log\listener.log
    Summary table degli endpoint di ascolto...
    (DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(PIPENAME=\\.\pipe\EXTPROC_FOR_XEipc)))
    (DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=127.0.0.1)(PORT=1521)))
    (DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=MyPCName)(PORT=8080))(Presentation=HTTP)(Session=RAW))
    Summary table dei servizi...
    Il servizio "CLRExtProc" ha 1 istanze.
    L'istanza "CLRExtProc", stato UNKNOWN, ha 1 handler per questo servizio...
    Il servizio "PLSExtProc" ha 1 istanze.
    L'istanza "PLSExtProc", stato UNKNOWN, ha 1 handler per questo servizio...
    Il servizio "XEXDB" ha 1 istanze.
    L'istanza "xe", stato READY, ha 1 handler per questo servizio...
    Il servizio "XE_XPT" ha 1 istanze.
    L'istanza "xe", stato READY, ha 1 handler per questo servizio...
    Il servizio "xe" ha 1 istanze.
    L'istanza "xe", stato READY, ha 1 handler per questo servizio...
    Environment:
    Win7 Pro SP1
    Oracle XE 10.2.0
    I have stopped the Win firewall and the problem is still there, so it is not a firewall problem
    listener.ora configuration
    SID_LIST_LISTENER =
    (SID_LIST =
    (SID_DESC =
    (SID_NAME = PLSExtProc)
    (ORACLE_HOME = C:\programs\oraclexe\app\oracle\product\10.2.0\server)
    (PROGRAM = extproc)
    (SID_DESC =
    (SID_NAME = CLRExtProc)
    (ORACLE_HOME = C:\programs\oraclexe\app\oracle\product\10.2.0\server)
    (PROGRAM = extproc)
    LISTENER =
    (DESCRIPTION_LIST =
    (DESCRIPTION =
    (ADDRESS = (PROTOCOL = IPC)(KEY = EXTPROC_FOR_XE))
    (ADDRESS = (PROTOCOL = TCP)(HOST = MyPCName)(PORT = 1521))
    DEFAULT_SERVICE_LISTENER = (XE)
    tnsnames.ora
    XE =
    (DESCRIPTION =
    (ADDRESS = (PROTOCOL = TCP)(HOST = MyPCName)(PORT = 1521))
    (CONNECT_DATA =
    (SERVER = DEDICATED)
    (SERVICE_NAME = XE)
    EXTPROC_CONNECTION_DATA =
    (DESCRIPTION =
    (ADDRESS_LIST =
    (ADDRESS = (PROTOCOL = IPC)(KEY = EXTPROC_FOR_XE))
    (CONNECT_DATA =
    (SID = PLSExtProc)
    (PRESENTATION = RO)
    Any help ?

    Hi;
    Pelase close this tread as answered and keep update issue at:
    Re: XE connection problem after using Cisco AnyConnect Client
    Regard
    Helios

  • Cisco AnyConnect VPN won't install, says There is a newer version of the AnyConnect client already installed

    I had an issue with my Cisco Anyconnect VPN not working, so uninstalled it. I've tried a new install and now I get the message "There is a newer version of the AnyConnect client installed" and it won't tell me install it at all. I've gone through various recommendations on the site included this :-
    Go to "Regedit" and search for "Deterministic Networks" and delete it.
    HKEY_LOCAL_MACHINE \SOFTWARE\Deterministic Networks
    Search with the following keywords in the registry, under "Uninstall" or  "Components" folders and delete any related entries.
    Vpnapi
    Vpngui
    Cisco
    CVPND
    CVPNDRA
    Ipsecdialer
    Source: https://supportforums.cisco.com/message/3728011#3728011
    But I've still got the same problem, and just cant find anything to help !

    Disable Internet Connection Sharing (ICS) and then try You can disable ICS in two ways:
    Per Adapter:
    Click the Start button.
    Click on Control Panel.
    Click on View Network Status and Tasks
    Click on Change adapter settings
    Right-click the shared connection and choose Properties
    Click the Sharing tab
    Clear the Allow other network users to connect through this computer's Internet connection checkbox
    Click OK
    System Wide:
    Click the Start button (Windows' orb)
    Type: services.msc and press ENTER
    Double-Click on Internet Connection Sharing (ICS)
    Change Startup Type to Disabled
    Reboot the computer
    You can now try reinstalling the WiscVPN client again

  • Error while crawling LOB contents in SP 2013:'Could not find default endpoint element that references contract in the ServiceModel client configuration section

    Hi,
    I created custom BDC Model using Visual Studio. In ReadList method i am getting data using Web Service call. Using this External Content Type (BDC Model) i created one external list and it is populating with data.
    I created one new content source in search service application using this BDC Model and when crawled this content source i am getting the below error.
    Error while crawling LOB contents. ( Error caused by exception: Microsoft.BusinessData.Runtime.RuntimeException MethodInstance with Name 'ReadList' on Entity (External Content Type) with Name 'Entity1' in Namespace 'bcsex.BdcModel1' failed
    unexpectedly. The failure occurred in method 'ReadList' defined in class 'bcsex.BdcModel1.EntityService1' with the message 'Could not find default endpoint element that references contract 'ServiceReference1.Service1Soap' in the ServiceModel client configuration
    section.
    I included the bindings and client end point configuration settings in web.config file located at
    \\Inetpub\wwwroot\wss\VirtualDirectories\Port_Number, but still getting the same error.
    Please help. Thanks a lot.

    The Issue resolved by including the bindings and client end point configuration settings in
    machine.config file located at C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\ and also restarted the server after config changes.

  • Windows 8.1 Preview not working with AnyConnect Client

    I had Windows 8 and was running Cisco AnyConnect client 3.0.10055 perfectly.
    I upgraded to the Windows 8.1 preview and it tries to download update and then it fails and disconnects with the following message:
    An unknown termination error occurred in the client.
    Tried uninstalling and reinstalling the client, no luck.
    Any ideas?
    Thanks,
    Eric

    I had the same issue with windows 8.1 x64. I believe there is an issue with the windows 8.1 update process where it fails to update some of the drivers properly. I have noticed this issue with other windows drivers after the update. Follow the steps below and you VPN should work again.
    1. Uninstall Cisco Anyconnect client.
    2. Go to Device Manager and Disable Cisco AnyConnect VPN Virtual Miniport Adapter for Windows x64
    3. Go to C:\Windows\System32 and rename vpnva64.sys to vpnva64_Old.sys.
    4. Reinstall Cisco Anyconnect client.
    5. Go to Device Manager, you see duplicated Cisco AnyConnect VPN Virtual Adapters. Uninstall one of them but do not check the option to remove the driver.
    6. Apply the registry fix in this blog: http://www.tomontech.com/2012/03/pro-tip-cisco-anyconnect-vpn-client-and-windows-8-consumer-preview/
    7. Try to connect again and your Cisco VPN should work. 

  • Assigning AnyConnect Client Profiles based on the machine?

    I have an ASA running 8.2.x code with AnyConnect 2.4.x.I have both Radius and LDAP (AD) AAA available.
    If a user connects from a company owned laptop, I want to push down AnyConnect client ProfileA (with scripts to map drives etc...) and network ACL's set A.
    If a user connects from any other computer, I want to push down AnyConnect client ProfileB (no scripts etc...) and network ACL's set B.
    What I would like to do is CSD to do a machine certificate check (for presence of a cert from my private CA) and to assign a EndPoint Policy attribute (Managed on successful check or Unmanaged on failure). I can then use DAP to tailor the ACL's that get set.
    It seems like the only way to handle AnyConnect client profiles is with Group-Policy. Using LDAP I can assign a user to a Group-Policy, but I have no way of determining is they are coming in from a company laptop or not when assigning the Group-Policy. DAP can not assign an AnyConnect client profile.
    If at all possible, I do not users to have to pick a conenction profile or use different URL's.
    Is there anyway to accomplish this?

    Hi
    Did you ever resolve this issue?  I am trying to assign a specific IP address based on the hostname or machine cert but the certificate matching doesn't seem to look at the machine cert.
    Has anyone got any idea how I could do this?
    thanks
    Steve

Maybe you are looking for