AnyConnect Client Multiple VPNs

We consult to multiple organizations and are provided VPN access to most of them. Is there a way to configure the AnyConnect to show a list of VPNs to connect to as opposed to having to enter the address everytime we want to connect?

Hi,
For this you can use the "server list" feature in the XML profile:
Server List
Or just use group-alias:
ASA 8.x: Allow Users to Select a Group at WebVPN Login via Group-Alias and Group-URL Method
Let me know.
Portu.
Please rate any post you find helpful.

Similar Messages

  • ASA and ACS 5 multiple VPN profiles for one user

    Hi there
    I have a question about ACS 5.3 and ASA VPN profile authorization. I am not sure if it is possible to allow one single user for a set of VPN profiles on ASA, let's make an example:
    ACS 5.3 group hierarchy:
    - VPN users global
    -- VPN users A
    -- VPN users B
    ASA VPN profiles:
    - VPN profile A
    - VPN profile B
    - VPN profile Z
    VPN authorizations:
    1. VPN users global should have access to VPN profiles A, B and Z (here we create an authorization profile with no class an no lock attributes, so the group is allowed for all VPN profiles)
    2. VPN users A should have access to VPN profile A (here we create a authorization profile with class and lock attributes for profile A)
    3. VPN users B should have access to VPN profiles B and Z (is this possible and how does the authorization profile have to look like?)
    Thanks a lot in advance and best regards
    Dominic

    Hi Dominic,
    first of all, let's clarify that on the ASA you have tunnel-groups (named connection profiles in ASDM) and group-policies. These often, but not always, have a one-to-one mapping.
    The Tunnel-Group (TG) is either selected by the user (either from a drop down list or by entering a specifiv group-url), or automatically selected by a certificate map (i.e. based on a certain field in the user cert, the user is mapped to one TG or another). The TG mainly specifies what kind of authentication is used.
    The Group-Policy (GP) by default is the one specified in the TG, but it can be overridden by e.g. Radius.
    So from the ASA's standpoint itself your posibilities are rather limited: the ASA will just apply whatever group-policy you push from Radius (in IETF attribute 25 aka "Class"), and in addition it will deny access to a user if the TG he selected does not match the value of the group-lock attribute. Group-lock can only contain one TG name, so you cannot do something like "allow both B and Z".
    In other words you can not achieve your goal if the Radius server has a "static" set of attributes per user.
    However, as of ASA 8.4.3 the ASA now sends 2 vendor-specific attributes in the Access-Request:
    vendor ID = 3076, attribute 146 is "Tunnel Group Name" (string).
    vendor ID = 3076, attribute 150 is "Client Type" (integer)
    0 = No Client specified  1 = Cisco VPN Client (IKEv1)  2 = AnyConnect Client SSL VPN  3 = Clientless SSL VPN  4 = Cut-Through-Proxy  5 = L2TP/IPsec SSL VPN  6 = AnyConnect Client IPsec VPN (IKEv2)
    So if you can configure the Radius server to "dynamically" permit/deny access based on the TG attribute I suppose you could achieve what you want.
    If/how ACS can do this, I personally don't know; I suggest you ask in the AAA forum if you need help with that part.
    hth
    Herbert

  • AnyConnect Secure Mobility Client Multiple Profiles

    Hi,
    I have multiple clients that use multiple versions of VPNs including Cisco, Sonicwall and others.
    I have a client with the (older) "Cisco Systems VPN Client".  Then I got a new client with instructions to install the "Cisco AnyConnect Secure Mobility Client".  Without warning, the installation uninstalled what I now believe was an older version of this same VPN client - but the name has changed, the installation directories have changed, etc.
    OK, but the new client wiped out the connection parameters to the old client.
    I've tried to read and understand the other discussion entries about storing multiple "profiles" (i.e. vpn connections).  Other VPN clients have a menu option or a simple way to add a connection, but it seems more challenging to do this with the AnyConnect client.  However, I read, and tried to set up, multiple profiles.  From the other discussions, I followed these steps:
    1. Located the (hidden in Windows 7) following directory:
         %ProgramData%\Cisco\Cisco AnyConnect Secure Mobility Client\Profile
    2.  Created two xml files, "Client1.xml" and "Client2.xml" in this directory. containing
    <?xml version="1.0" encoding="UTF-8"?>
    <AnyConnectProfile xmlns="http://schemas.xmlsoap.org/encoding/">
      <ServerList>
        <HostEntry>
          <HostName>Client1HostName</HostName>
          <HostAddress>Client1HostaddressDNS</HostAddress>
          <PrimaryProtocol>IPsec</PrimaryProtocol>
        </HostEntry>
      </ServerList>
    </AnyConnectProfile>
    {And a similar file for Client2}
    There was another discussion thread that had more lines in the xml file, which I also tried.  Again, I created 2 separate xml files, each one with the respective client's parameters.
    <?xml version="1.0" encoding="UTF-8"?>
    <AnyConnectProfile xmlns="http://schemas.xmlsoap.org/encoding/">
    <ServerList>
         <HostEntry>
              <User>navadmin</User>
              <SecondUser></SecondUser>
              <ClientCertificateThumbprint></ClientCertificateThumbprint>
              <ServerCertificateThumbprint></ServerCertificateThumbprint>
              <HostName>Client1</HostName>
              <HostAddress>Client1DNS</HostAddress>
              <Domain></Domain>
              <Group>ssl_url</Group>
              <ProxyHost></ProxyHost>
              <ProxyPort></ProxyPort>
              <SDITokenType>none</SDITokenType>
              <ControllablePreferences>
              <LocalLanAccess>true</LocalLanAccess></ControllablePreferences>
         </HostEntry>
    </ServerList>
    </AnyConnectProfile>
    I then quit the AnyConnect Secure Mobility Client and restarted, hoping that I would get a dropdown list that contained "Client1" and "Client2".  This did not happen.
    Prior to trying this, I did NOT delete the "Preferences.xml" file in the following directory:
    C:\users\<myusername>\AppData\Local\Cisco\Cisco AnyConnect Secure Mobility Client
    This is where the Anyconnect client stored the connection info when I manually input it into the GUI.
    So, my questions are:
    1.     Do I need to delete the preferences.xml in order for the profiles in the other directory to be read and displayed in the client dropdown?
    2.     Are there naming conventions for the profile xml files that I'm not following by calling them "Client1.xml" and "Client2.xml"?
    3.     Any other ideas as to why this isn't working?
    4.     There are also references to a "profile editor", but the discussion threads aren't clear whether this utility is installed when you just install the client software, or if you have to have some sort of "administrator package" installed.  If so, is this package available for download, or do you need to purchase a full VPN client license in order to have access to this utility?
    Thanks,
    Ron

    The Client1.xml and Client2.xml files that you created have correct content but wrong names. You only need 1 file called Profile.xml and inside you can then add multiple hosts by adding the nodes.
    So your Profile.xml would look like this -
    <?xml version="1.0" encoding="UTF-8"?>
    http://schemas.xmlsoap.org/encoding/">
          Client1HostName
          Client1HostaddressDNS
          IPsec
          Client2HostName
          Client2HostaddressDNS
          IPsec
    I hope this helps.
    Ratan.

  • ASA Remote Access VPN Clients - Multiple DNS Suffixes?

    Hi community!
    I am setting up a new remote access VPN using the traditional IPSec client via ASA 5515-X runnning OS 8.6.1(5).
    We require to provide each client multiple DNS suffixes, but are only to provide a single DNS suffix in the grouip policy.
    I have tested using an external DHCP server, but using our Windows Server 2008 infrastructure and Option 119 the list is not provided to clients, and I have read that Windows 7 clietns may ignore this option anyway.
    Other than umanually configuring the clients , does anybody have any other suggestions on how we may get this to work?
    Full marks for helpful posts!
    Kind regards, Ash.

    Hi
    I am looking into the same issue, and I am finding conflicting documentation about this and wondered if you got the answers you were looking for.
    I have a remote access requirement for users from separate AD's to authenticate through an ASA.
    I was reading about Global Catalogue Server but this is not specifically what I want; and also creating a new AAA server group but the user would need to accept which group to use when they log in
    Regards

  • Cisco AnyConnect VPN won't install, says There is a newer version of the AnyConnect client already installed

    I had an issue with my Cisco Anyconnect VPN not working, so uninstalled it. I've tried a new install and now I get the message "There is a newer version of the AnyConnect client installed" and it won't tell me install it at all. I've gone through various recommendations on the site included this :-
    Go to "Regedit" and search for "Deterministic Networks" and delete it.
    HKEY_LOCAL_MACHINE \SOFTWARE\Deterministic Networks
    Search with the following keywords in the registry, under "Uninstall" or  "Components" folders and delete any related entries.
    Vpnapi
    Vpngui
    Cisco
    CVPND
    CVPNDRA
    Ipsecdialer
    Source: https://supportforums.cisco.com/message/3728011#3728011
    But I've still got the same problem, and just cant find anything to help !

    Disable Internet Connection Sharing (ICS) and then try You can disable ICS in two ways:
    Per Adapter:
    Click the Start button.
    Click on Control Panel.
    Click on View Network Status and Tasks
    Click on Change adapter settings
    Right-click the shared connection and choose Properties
    Click the Sharing tab
    Clear the Allow other network users to connect through this computer's Internet connection checkbox
    Click OK
    System Wide:
    Click the Start button (Windows' orb)
    Type: services.msc and press ENTER
    Double-Click on Internet Connection Sharing (ICS)
    Change Startup Type to Disabled
    Reboot the computer
    You can now try reinstalling the WiscVPN client again

  • Anyconnect Client Customization?

    Greetings,
    We are using Anyconnect 2.3.0254 client + SBL/gina and are looking to customize the client even further to prevent user from Disconnecting from the VPN tunnel.
    Basically we have remote users that come in on EVDO using Verizon VZaccess Manager. I have that set to start before login and the VPN as well. All of the works great, but once the user is fully logged in, they can then disconnect from either or both. Using VZAccess manager, I can say the vpn has to be connected, but the if vpn profile does not auto launch completely, it fails. So my other thought is just to block disconnecting from the VPN for those users. I have looked all through the XML customization files for anyconnect, but see nothing for either prevent client disconnect, or autolaunch profile entirely. Am I missing something, or is this not possible? Any other suggestions?
    Thanks.
    bldavis

    User profiles are created by an administrator and are automatically delivered to a client machine during connection setup. Profiles provide basic information about connection setup, and users cannot manage or modify them.
    An AnyConnect client user profile is an XML file that lets you identify the secure gateway (security appliance) hosts that you want to make accessible. In addition, the profile conveys additional connection attributes and constraints on a user.
    Usually, a user has a single profile file. This profile contains all the hosts needed by a user, and additional settings as needed. In some cases, you might want to provide more than one profile for a given user. For example, someone who works from multiple locations might need more than one profile. In such cases, the user selects the appropriate profile from a drop-down list. Be aware, however, that some of the profile settings, such as Start Before Login, control the connection experience at a global level. Other settings, such as those unique to a particular host, depend on the host selected.

  • Communication problem from the vpn-anyconnect to easy-vpn-remote

    Hi Team,
    I have a communication problem from the vpn-anyconnect to easy-vpn-remote, I´ll explain better bellow and see the attached
    topology:
    1) VPN Tunnel between HQ to Branch Office - That´s OK
    2) VPN Tunnel between Client AnyConnect to HQ - That´s OK
    The idea is that the Client Anyconnect is to reach the LAN at Branch Office, but did not reach.
    The communication is stablished just when I start a session (icmp and/or rdp) from Branch Office to the Client AnyConnect,
    in this way, the communication is OK, but just during a few minutes.
    Could you help me?
    Bellow the IOS version and configurations
    ASA5505 Version 8.4(7)23 (headquarters)
    ASA5505 Version 8.4(7)23 (Branch)
    **************** Configuration Easy VPN Server (HQ) **************** 
    crypto dynamic-map DYNAMIC-MAP 5 set ikev1 transform-set ESP-AES-256-SHA
    crypto map outside-link-2_map 1 ipsec-isakmp dynamic DYNAMIC-MAP
    crypto map outside-link-2_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map outside-link-2_map interface outside-link-2
    access-list ACL_EZVPN standard permit 10.0.0.0 255.255.255.0 
    access-list ACL_EZVPN standard permit 192.168.1.0 255.255.255.0 
    access-list ACL_EZVPN standard permit 192.168.50.0 255.255.255.0 
    access-list ACL_EZVPN standard permit 10.10.0.0 255.255.255.0 
    group-policy EZVPN_GP internal
    group-policy EZVPN_GP attributes
     split-tunnel-policy tunnelspecified
     split-tunnel-network-list value ACL_EZVPN
     nem enable 
    tunnel-group EZVPN_TG type remote-access
    tunnel-group EZVPN_TG general-attributes
     default-group-policy EZVPN_GP
    tunnel-group EZVPN_TG ipsec-attributes
     ikev1 pre-shared-key *****
    object-group network Obj_VPN_anyconnect-local
     network-object 192.168.1.0 255.255.255.0
     network-object 192.168.15.0 255.255.255.0
    object-group network Obj-VPN-anyconnect-remote
     network-object 192.168.50.0 255.255.255.0
    object-group network NAT_EZVPN_Source
     network-object 192.168.1.0 255.255.255.0
     network-object 10.10.0.0 255.255.255.0
    object-group network NAT_EZVPN_Destination
     network-object 10.0.0.0 255.255.255.0
    nat (inside,outside-link-2) source static Obj_VPN_anyconnect-local Obj_VPN_anyconnect-local destination static Obj-VPN-
    anyconnect-remote Obj-VPN-anyconnect-remote no-proxy-arp route-lookup
    nat (inside,outside-link-2) source static NAT_EZVPN_Source NAT_EZVPN_Source destination static NAT_EZVPN_Destination 
    NAT_EZVPN_Destination no-proxy-arp route-lookup
    nat (outside-link-2,outside-link-2) source static Obj-VPN-anyconnect-remote Obj-VPN-anyconnect-remote destination static 
    NAT_EZVPN_Destination NAT_EZVPN_Destination no-proxy-arp route-lookup
    **************** Configuration VPN AnyConnect (HQ) **************** 
    webvpn
     enable outside-link-2
     default-idle-timeout 60
     anyconnect-essentials
     anyconnect image disk0:/anyconnect-win-2.5.2014-k9.pkg 1
     anyconnect profiles Remote_Connection_for_TS_Users disk0:/remote_connection_for_ts_users.xml
     anyconnect enable
     tunnel-group-list enable
    access-list split-tunnel standard permit 192.168.1.0 255.255.255.0 
    access-list split-tunnel standard permit 192.168.15.0 255.255.255.0 
    access-list split-tunnel standard permit 10.0.0.0 255.255.255.0 
    group-policy clientgroup internal
    group-policy clientgroup attributes
     wins-server none
     dns-server value 192.168.1.41
     vpn-tunnel-protocol ssl-client 
     split-tunnel-policy tunnelspecified
     split-tunnel-network-list value split-tunnel
     default-domain value ipconnection.com.br
     webvpn       
      anyconnect keep-installer installed
      anyconnect ssl rekey time 30
      anyconnect ssl rekey method ssl
      anyconnect profiles value Remote_Connection_for_TS_Users type user
      anyconnect ask none default anyconnect
    tunnel-group sslgroup type remote-access
    tunnel-group sslgroup general-attributes
     address-pool vpnpool
     authentication-server-group DC03
     default-group-policy clientgroup
    tunnel-group sslgroup webvpn-attributes
     group-alias IPConnection-vpn-anyconnect enable
    object-group network Obj_VPN_anyconnect-local
     network-object 192.168.1.0 255.255.255.0
     network-object 192.168.15.0 255.255.255.0
    object-group network Obj-VPN-anyconnect-remote
     network-object 192.168.50.0 255.255.255.0
    object-group network NAT_EZVPN_Source
     network-object 192.168.1.0 255.255.255.0
     network-object 10.10.0.0 255.255.255.0
    object-group network NAT_EZVPN_Destination
     network-object 10.0.0.0 255.255.255.0
    nat (inside,outside-link-2) source static Obj_VPN_anyconnect-local Obj_VPN_anyconnect-local destination static Obj-VPN-
    anyconnect-remote Obj-VPN-anyconnect-remote no-proxy-arp route-lookup
    nat (inside,outside-link-2) source static NAT_EZVPN_Source NAT_EZVPN_Source destination static NAT_EZVPN_Destination 
    NAT_EZVPN_Destination no-proxy-arp route-lookup
    nat (outside-link-2,outside-link-2) source static Obj-VPN-anyconnect-remote Obj-VPN-anyconnect-remote destination static 
    NAT_EZVPN_Destination NAT_EZVPN_Destination no-proxy-arp route-lookup

    Hi,
    the communication works when you send traffic from easyvpn branch side because it froms the IPSEC SA for local subnet and anyconnect HQ pool. The SA will only form when branch initiates the connection as this is dynamic peer connection to HQ ASA.
    when there no SA between branch and HQ for this traffic, HQ ASA has no clue about where to send the traffic from anyconnect to branch network.
    I hope it explains the cause.
    Regards,
    Abaji.

  • AnyConnect error " User not authorized for AnyConnect Client access, contact your administrator"

    Hi everyone,
    it's probably just me but I have tried real hard to get a simple AnyConnect setup working in a lab environment on my ASA 5505 at home, without luck. When I connect with the AnyConnect client I get the error message "User not authorized for AnyConnect Client access, contact your administrator". I have searched for this error and tried some of the few solutions out there, but to no avail. I also updated the ASA from 8.4.4(1) to 9.1(1) and ASDM from 6.4(9) to 7.1(1) but still the same problem. The setup of the ASA is straight forward, directly connected to the Internet with a 10.0.1.0 / 24 subnet on the inside and an address pool of 10.0.2.0 / 24 to assign to the VPN clients. Please note that due to ISP restrictions, I'm using port 44455 instead of 443. I had AnyConnect working with the SSL portal, but IKEv2 IPsec is giving me a headache. I have stripped down certificate authentication which I had running before just to eliminate this as a potential cause of the issue. When running debugging, I do not get any error messages - the handshake completes successfully and the local authentication works fine as well.
    Please find the current config and debugging output below. I appreciate any pointers as to what might be wrong here.
    : Saved
    ASA Version 9.1(1)
    hostname ASA
    domain-name ingo.local
    enable password ... encrypted
    xlate per-session deny tcp any4 any4
    xlate per-session deny tcp any4 any6
    xlate per-session deny tcp any6 any4
    xlate per-session deny tcp any6 any6
    xlate per-session deny udp any4 any4 eq domain
    xlate per-session deny udp any4 any6 eq domain
    xlate per-session deny udp any6 any4 eq domain
    xlate per-session deny udp any6 any6 eq domain
    passwd ... encrypted
    names
    name 10.0.1.0 LAN-10-0-1-x
    dns-guard
    ip local pool VPNPool 10.0.2.1-10.0.2.10 mask 255.255.255.0
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
    nameif Internal
    security-level 100
    ip address 10.0.1.254 255.255.255.0
    interface Vlan2
    nameif External
    security-level 0
    ip address dhcp setroute
    regex BlockFacebook "facebook.com"
    banner login This is a monitored system. Unauthorized access is prohibited.
    boot system disk0:/asa911-k8.bin
    ftp mode passive
    clock timezone PST -8
    clock summer-time PDT recurring
    dns domain-lookup Internal
    dns domain-lookup External
    dns server-group DefaultDNS
    name-server 10.0.1.11
    name-server 75.153.176.1
    name-server 75.153.176.9
    domain-name ingo.local
    object network obj_any
    subnet 0.0.0.0 0.0.0.0
    object network LAN-10-0-1-x
    subnet 10.0.1.0 255.255.255.0
    object network Company-IP1
    host xxx.xxx.xxx.xxx
    object network Company-IP2
    host xxx.xxx.xxx.xxx
    object network HYPER-V-DUAL-IP
    range 10.0.1.1 10.0.1.2
    object network LAN-10-0-1-X
    access-list 100 extended permit tcp any4 object HYPER-V-DUAL-IP eq 3389 inactive
    access-list 100 extended permit tcp object Company-IP1 object HYPER-V-DUAL-IP eq 3389
    access-list 100 extended permit tcp object Company-IP2 object HYPER-V-DUAL-IP eq 3389 
    tcp-map Normalizer
      check-retransmission
      checksum-verification
    no pager
    logging enable
    logging timestamp
    logging list Threats message 106023
    logging list Threats message 106100
    logging list Threats message 106015
    logging list Threats message 106021
    logging list Threats message 401004
    logging buffered errors
    logging trap Threats
    logging asdm debugging
    logging device-id hostname
    logging host Internal 10.0.1.11 format emblem
    logging ftp-bufferwrap
    logging ftp-server 10.0.1.11 / asa *****
    logging permit-hostdown
    mtu Internal 1500
    mtu External 1500
    ip verify reverse-path interface Internal
    ip verify reverse-path interface External
    icmp unreachable rate-limit 1 burst-size 1
    icmp deny any echo External
    asdm image disk0:/asdm-711.bin
    no asdm history enable
    arp timeout 14400
    no arp permit-nonconnected
    object network obj_any
    nat (Internal,External) dynamic interface
    object network LAN-10-0-1-x
    nat (Internal,External) dynamic interface
    object network HYPER-V-DUAL-IP
    nat (Internal,External) static interface service tcp 3389 3389
    access-group 100 in interface External
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    aaa-server radius protocol radius
    aaa-server radius (Internal) host 10.0.1.11
    key *****
    radius-common-pw *****
    user-identity default-domain LOCAL
    aaa authentication ssh console radius LOCAL
    http server enable
    http LAN-10-0-1-x 255.255.255.0 Internal
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec ikev2 ipsec-proposal DES
    protocol esp encryption des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal 3DES
    protocol esp encryption 3des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES
    protocol esp encryption aes
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES192
    protocol esp encryption aes-192
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES256
    protocol esp encryption aes-256
    protocol esp integrity sha-1 md5
    crypto ipsec security-association pmtu-aging infinite
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
    crypto map External_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map External_map interface External
    crypto ca trustpoint srv01_trustpoint
    enrollment terminal
    crl configure
    crypto ca trustpoint asa_cert_trustpoint
    keypair asa_cert_trustpoint
    crl configure
    crypto ca trustpoint LOCAL-CA-SERVER
    keypair LOCAL-CA-SERVER
    crl configure
    crypto ca trustpool policy
    crypto ca server
    cdp-url http://.../+CSCOCA+/asa_ca.crl:44435
    issuer-name CN=...
    database path disk0:/LOCAL_CA_SERVER/
    smtp from-address ...
    publish-crl External 44436
    crypto ca certificate chain srv01_trustpoint
    certificate <output omitted>
      quit
    crypto ca certificate chain asa_cert_trustpoint
    certificate <output omitted>
      quit
    crypto ca certificate chain LOCAL-CA-SERVER
    certificate <output omitted>
      quit
    crypto ikev2 policy 1
    encryption aes-256
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 10
    encryption aes-192
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 20
    encryption aes
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 30
    encryption 3des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 40
    encryption des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 enable External client-services port 44455
    crypto ikev2 remote-access trustpoint asa_cert_trustpoint
    telnet timeout 5
    ssh LAN-10-0-1-x 255.255.255.0 Internal
    ssh xxx.xxx.xxx.xxx 255.255.255.255 External
    ssh xxx.xxx.xxx.xxx 255.255.255.255 External
    ssh timeout 5
    ssh version 2
    console timeout 0
    no vpn-addr-assign aaa
    no ipv6-vpn-addr-assign aaa
    no ipv6-vpn-addr-assign local
    dhcpd dns 75.153.176.9 75.153.176.1
    dhcpd domain ingo.local
    dhcpd option 3 ip 10.0.1.254
    dhcpd address 10.0.1.50-10.0.1.81 Internal
    dhcpd enable Internal
    threat-detection basic-threat
    threat-detection scanning-threat shun except ip-address LAN-10-0-1-x 255.255.255.0
    threat-detection statistics access-list
    threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
    dynamic-filter use-database
    dynamic-filter enable interface Internal
    dynamic-filter enable interface External
    dynamic-filter drop blacklist interface Internal
    dynamic-filter drop blacklist interface External
    ntp server 128.233.3.101 source External
    ntp server 128.233.3.100 source External prefer
    ntp server 204.152.184.72 source External
    ntp server 192.6.38.127 source External
    ssl encryption aes256-sha1 aes128-sha1 3des-sha1
    ssl trust-point asa_cert_trustpoint External
    webvpn
    port 44433
    enable External
    dtls port 44433
    anyconnect image disk0:/anyconnect-win-3.1.02026-k9.pkg 1
    anyconnect profiles profile1 disk0:/profile1.xml
    anyconnect enable
    smart-tunnel list SmartTunnelList1 mstsc mstsc.exe platform windows
    smart-tunnel list SmartTunnelList1 putty putty.exe platform windows
    group-policy DfltGrpPolicy attributes
    vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec ssl-client ssl-clientless
    webvpn
      anyconnect profiles value profile1 type user
    username write.ingo password ... encrypted
    username ingo password ... encrypted privilege 15
    username tom.tucker password ... encrypted
    class-map TCP
    match port tcp range 1 65535
    class-map type regex match-any BlockFacebook
    match regex BlockFacebook
    class-map type inspect http match-all BlockDomains
    match request header host regex class BlockFacebook
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 1500
      id-randomization
    policy-map TCP
    class TCP
      set connection conn-max 1000 embryonic-conn-max 1000 per-client-max 250 per-client-embryonic-max 250
      set connection timeout dcd
      set connection advanced-options Normalizer
      set connection decrement-ttl
    policy-map type inspect http HTTP
    parameters
      protocol-violation action drop-connection log
    class BlockDomains
    policy-map global_policy
    class inspection_default
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny 
      inspect sunrpc
      inspect xdmcp
      inspect sip 
      inspect netbios
      inspect tftp
      inspect ip-options
      inspect dns preset_dns_map dynamic-filter-snoop
      inspect http HTTP
    service-policy global_policy global
    service-policy TCP interface External
    smtp-server 199.185.220.249
    privilege cmd level 3 mode exec command perfmon
    privilege cmd level 3 mode exec command ping
    privilege cmd level 3 mode exec command who
    privilege cmd level 3 mode exec command logging
    privilege cmd level 3 mode exec command failover
    privilege cmd level 3 mode exec command vpn-sessiondb
    privilege cmd level 3 mode exec command packet-tracer
    privilege show level 5 mode exec command import
    privilege show level 5 mode exec command running-config
    privilege show level 3 mode exec command reload
    privilege show level 3 mode exec command mode
    privilege show level 3 mode exec command firewall
    privilege show level 3 mode exec command asp
    privilege show level 3 mode exec command cpu
    privilege show level 3 mode exec command interface
    privilege show level 3 mode exec command clock
    privilege show level 3 mode exec command dns-hosts
    privilege show level 3 mode exec command access-list
    privilege show level 3 mode exec command logging
    privilege show level 3 mode exec command vlan
    privilege show level 3 mode exec command ip
    privilege show level 3 mode exec command failover
    privilege show level 3 mode exec command asdm
    privilege show level 3 mode exec command arp
    privilege show level 3 mode exec command ipv6
    privilege show level 3 mode exec command route
    privilege show level 3 mode exec command ospf
    privilege show level 3 mode exec command aaa-server
    privilege show level 3 mode exec command aaa
    privilege show level 3 mode exec command eigrp
    privilege show level 3 mode exec command crypto
    privilege show level 3 mode exec command ssh
    privilege show level 3 mode exec command vpn-sessiondb
    privilege show level 3 mode exec command vpnclient
    privilege show level 3 mode exec command vpn
    privilege show level 3 mode exec command dhcpd
    privilege show level 3 mode exec command blocks
    privilege show level 3 mode exec command wccp
    privilege show level 3 mode exec command dynamic-filter
    privilege show level 3 mode exec command webvpn
    privilege show level 3 mode exec command service-policy
    privilege show level 3 mode exec command module
    privilege show level 3 mode exec command uauth
    privilege show level 3 mode exec command compression
    privilege show level 3 mode configure command interface
    privilege show level 3 mode configure command clock
    privilege show level 3 mode configure command access-list
    privilege show level 3 mode configure command logging
    privilege show level 3 mode configure command ip
    privilege show level 3 mode configure command failover
    privilege show level 5 mode configure command asdm
    privilege show level 3 mode configure command arp
    privilege show level 3 mode configure command route
    privilege show level 3 mode configure command aaa-server
    privilege show level 3 mode configure command aaa
    privilege show level 3 mode configure command crypto
    privilege show level 3 mode configure command ssh
    privilege show level 3 mode configure command dhcpd
    privilege show level 5 mode configure command privilege
    privilege clear level 3 mode exec command dns-hosts
    privilege clear level 3 mode exec command logging
    privilege clear level 3 mode exec command arp
    privilege clear level 3 mode exec command aaa-server
    privilege clear level 3 mode exec command crypto
    privilege clear level 3 mode exec command dynamic-filter
    privilege cmd level 3 mode configure command failover
    privilege clear level 3 mode configure command logging
    privilege clear level 3 mode configure command arp
    privilege clear level 3 mode configure command crypto
    privilege clear level 3 mode configure command aaa-server
    prompt hostname context
    no call-home reporting anonymous
    call-home
    profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:41a021a28f73c647a2f550ba932bed1a
    : end
    Many thanks,
    Ingo

    Hi Jose,
    here is what I got now:
    ASA(config)# sh run | begin tunnel-group
    tunnel-group DefaultWEBVPNGroup general-attributes
    address-pool VPNPool
    authorization-required
    and DAP debugging still the same:
    ASA(config)# DAP_TRACE: DAP_open: CDC45080
    DAP_TRACE: Username: tom.tucker, aaa.cisco.grouppolicy = DfltGrpPolicy
    DAP_TRACE: Username: tom.tucker, aaa.cisco.username = tom.tucker
    DAP_TRACE: Username: tom.tucker, aaa.cisco.username1 = tom.tucker
    DAP_TRACE: Username: tom.tucker, aaa.cisco.username2 =
    DAP_TRACE: Username: tom.tucker, aaa.cisco.tunnelgroup = DefaultWEBVPNGroup
    DAP_TRACE: Username: tom.tucker, DAP_add_SCEP: scep required = [FALSE]
    DAP_TRACE: Username: tom.tucker, DAP_add_AC:
    endpoint.anyconnect.clientversion="3.1.02026";
    endpoint.anyconnect.platform="win";
    DAP_TRACE: Username: tom.tucker, dap_aggregate_attr: rec_count = 1
    DAP_TRACE: Username: tom.tucker, Selected DAPs: DfltAccessPolicy
    DAP_TRACE: Username: tom.tucker, DAP_close: CDC45080
    Unfortunately, it still doesn't work. Hmmm.. maybe a wipe of the config and starting from scratch can help?
    Thanks,
    Ingo

  • Windows 8.1 Preview not working with AnyConnect Client

    I had Windows 8 and was running Cisco AnyConnect client 3.0.10055 perfectly.
    I upgraded to the Windows 8.1 preview and it tries to download update and then it fails and disconnects with the following message:
    An unknown termination error occurred in the client.
    Tried uninstalling and reinstalling the client, no luck.
    Any ideas?
    Thanks,
    Eric

    I had the same issue with windows 8.1 x64. I believe there is an issue with the windows 8.1 update process where it fails to update some of the drivers properly. I have noticed this issue with other windows drivers after the update. Follow the steps below and you VPN should work again.
    1. Uninstall Cisco Anyconnect client.
    2. Go to Device Manager and Disable Cisco AnyConnect VPN Virtual Miniport Adapter for Windows x64
    3. Go to C:\Windows\System32 and rename vpnva64.sys to vpnva64_Old.sys.
    4. Reinstall Cisco Anyconnect client.
    5. Go to Device Manager, you see duplicated Cisco AnyConnect VPN Virtual Adapters. Uninstall one of them but do not check the option to remove the driver.
    6. Apply the registry fix in this blog: http://www.tomontech.com/2012/03/pro-tip-cisco-anyconnect-vpn-client-and-windows-8-consumer-preview/
    7. Try to connect again and your Cisco VPN should work. 

  • Anyconnect Client profile files deleted after client upgrade

    L.S.
    I am running anyconnect version 3.1.02040 on a Windows 7 64-bit machine with UAC turned on.
    The ASA I am connecting to is a 5510 running ASA OS 8.4.5
    The problem I have is the following:
    We are using machine certificate authentication combined with RADIUS user authentication.
    The machine certificates are stored in the Machine/Personal container in the local machine.
    By default, the anyconnect client does not have the rights to access this certificate store when run by the user in non-elevated mode.
    We do not want to have the user run the client as administrator (in elevated mode) all the time.
    Therefor we have made an Anyconnect Client profile that sets the Certificate Store Override parameter to true and attached it to the group policy.
    With this XML in place (in the C:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client\Profile folder)
    the users can connect to the ASA and authenticate using the certificate without the need for elevated rights. This is all working perfectly.
    The anyconnect client and XML file are distributed to the clients using a software distribution system (Microsoft SCCM).
    The problem happens when I update the Anyconnect package on the ASA. I recently updated the package to release 3.1.03103. This is what happens:
    The user can connect using the 3.1.02040 client (certicate authentication works without elevation, since the XML Anyconnect Client Profile is present)
    The Anyconnect software updates itself to the new version during the connection, pushed from the ASA.
    The VPN is established.
    However, the XML file that is associated with the group policy is deleted during the upgrade process and not placed back in the Profile folder on the client after the upgrade.
    This means the user cannot connect without using elevated rights the next time he wants to connect.
    If he uses elevated rights after the upgrade, the XML is pushed back from the ASA normally, allowing the user to connect without elevation again any subsequent times.
    Is there any way to push the XML profile to the client from the ASA after the upgrade of the Anyconnect software?

    Hi poiu720408 ,
    1.  You need to set up a web-url or group-alias under the group policy as web have enable the "tunnel-group-list enable" under the webvpn configuration.  So once the user connect to the proper URL/alias the profile will be applied. 
    http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/98580-enable-group-dropdown.html
    2. Yes the Anycopnnect store a "Cache " information on the PC , if you want to clan up you have to go to the anyconnect folder on C: on the PC and delete the global_preferences.xml profile.
    3. This behavior is totally expected and they should disappear  after a some minutes , however if you wan to force this , you can use the command "vpn-sessionsdb logoff webvpn noconfirm"
    Please rate helpful post !
    Hope this helps
    - Randy -

  • AnyConnect client reconnects after 1 minute

    AnyConnect client reconnects after 1 minute; WHY
    version 3.1.02026
    ASA:asa911-k8.bin
    [25-4-2013 8:16:11] Establishing VPN session...
    [25-4-2013 8:16:11] Checking for profile updates...
    [25-4-2013 8:16:11] Checking for product updates...
    [25-4-2013 8:16:11] Checking for customization updates...
    [25-4-2013 8:16:11] Performing any required updates...
    [25-4-2013 8:16:12] Establishing VPN session...
    [25-4-2013 8:16:12] Establishing VPN - Initiating connection...
    [25-4-2013 8:16:12] Establishing VPN - Examining system...
    [25-4-2013 8:16:12] Establishing VPN - Activating VPN adapter...
    [25-4-2013 8:16:15] Establishing VPN - Configuring system...
    [25-4-2013 8:16:16] Establishing VPN...
    [25-4-2013 8:16:16] Connected to my.vpn.com.
    [25-4-2013 8:16:16] Connected to my.vpn.com.
    [25-4-2013 8:17:19] Reconnecting to my.vpn.com...
    [25-4-2013 8:17:19] Establishing VPN - Examining system...
    [25-4-2013 8:17:24] Establishing VPN - Activating VPN adapter...
    [25-4-2013 8:17:25] Establishing VPN - Configuring system...
    [25-4-2013 8:17:25] Establishing VPN...
    [25-4-2013 8:17:25] Connected to my.vpn.com.
    [25-4-2013 8:17:25] Reconnecting to my.vpn.com...
    [25-4-2013 8:17:25] Establishing VPN - Examining system...
    [25-4-2013 8:17:25] Establishing VPN - Activating VPN adapter...
    [25-4-2013 8:17:25] Establishing VPN - Configuring system...
    [25-4-2013 8:17:25] Establishing VPN...
    [25-4-2013 8:17:25] Connected to my.vpn.com.
    [25-4-2013 8:16:11] Establishing VPN session...
    [25-4-2013 8:16:11] Checking for profile updates...
    [25-4-2013 8:16:11] Checking for product updates...
    [25-4-2013 8:16:11] Checking for customization updates...
    [25-4-2013 8:16:11] Performing any required updates...
    [25-4-2013 8:16:12] Establishing VPN session...
    [25-4-2013 8:16:12] Establishing VPN - Initiating connection...
    [25-4-2013 8:16:12] Establishing VPN - Examining system...
    [25-4-2013 8:16:12] Establishing VPN - Activating VPN adapter...
    [25-4-2013 8:16:15] Establishing VPN - Configuring system...
    [25-4-2013 8:16:16] Establishing VPN...
    [25-4-2013 8:16:16] Connected to my.vpn.com.
    [25-4-2013 8:16:16] Connected to my.vpn.com.
    [25-4-2013 8:17:19] Reconnecting to my.vpn.com...
    [25-4-2013 8:17:19] Establishing VPN - Examining system...
    [25-4-2013 8:17:24] Establishing VPN - Activating VPN adapter...
    [25-4-2013 8:17:25] Establishing VPN - Configuring system...
    [25-4-2013 8:17:25] Establishing VPN...
    [25-4-2013 8:17:25] Connected to my.vpn.com.
    [25-4-2013 8:17:25] Reconnecting to my.vpn.com...
    [25-4-2013 8:17:25] Establishing VPN - Examining system...
    [25-4-2013 8:17:25] Establishing VPN - Activating VPN adapter...
    [25-4-2013 8:17:25] Establishing VPN - Configuring system...
    [25-4-2013 8:17:25] Establishing VPN...
    [25-4-2013 8:17:25] Connected to my.vpn.com.

    Hello Michael,
    The problem here is because we cannot succesfully establish a DTLS tunnel. This could happen because:
    - DTLS is blocked somewhere in the path
    - A non-default DTLS port is being used
    If DTLS is blocked in the middle the issue is because as of ASA Release 9.x and AnyConnect Release 3.x, an optimization has been introduced in the form of distinct Maximum Transition Units (MTUs) that are negotiated for TLS/DTLS between the client/ASA. Previously, the client derived a rough estimate MTU which covered both TLS/DTLS and was obviously less than optimal. Now, the ASA computes the encapsulation overhead for both TLS/DTLS and derives the MTU values accordingly.
    As long as DTLS is enabled, the client applies the DTLS MTU (in this case 1418) on the VPN adapter (which is enabled before the DTLS tunnel is established and is needed for routes/filters enforcement), to ensure optimum performance. If the DTLS tunnel cannot be established or it is dropped at some point, the client fails over to TLS and adjusts the MTU on the virtual adapter (VA) to the TLS MTU value (this requires a session level reconnect).
    In order to eliminate this visible transition of DTLS > TLS,  you can configure a separate tunnel group for TLS only access for users that have trouble with the establishment of the DTLS tunnel (such as due to firewall restrictions).
    1. The best option is to set the AnyConnect MTU value to be lower than the TLS MTU, which is then negotiated.
    group-policy ac_users_group attributes
    webvpn
      anyconnect mtu 1300
    This makes TLS and DTLS MTU values equal. Reconnections are not seen in this case.
    2. The second option is to allow fragmentation.
    group-policy ac_users_group attributes
    webvpn
      anyconnect ssl df-bit-ignore enable
    With fragmentation, large packets (whose size exceeds the MTU value) can be fragmented and sent through the TLS tunnel.
    3. The third option is to set the Maximum Segment Size (MSS) to 1460 as follows:
    sysopt conn tcpmss 1460
    In this case, the TLS MTU will be 1427 (RC4/SHA1) which is larger than the DTLS MTU 1418 (AES/SHA1/LZS). This should resolve the issue with TCP from the ASA to the AnyConnect client (thanks to MSS), but large UDP traffic from the ASA to the AnyConnect client might suffer from this as it will be dropped by the AnyConnect client due to the lower AnyConnect client MTU 1418. If sysopt conn tcpmss is modified, it might affect other features such as LAN-to-LAN (L2L) IPSec VPN tunnels.
    If DTLS is not blocked in the middle another potential cause for the DTLS failure that DTLS is configured on a non-default port after the WebVPN is enabled (for example, when the webvpn enable outside command is entered). This is due to Cisco bug ID CSCuh61321 and has been seen in Release 9.x where the ASA pushes the non-default port to the client, but continues to listen to the default port. Consequently, the DTLS is not built and AnyConnect reconnects.
    The workaround for this problem is:
    Disable the WebVPN.
    Enter the DTLS port.
    Enable the WebVPN.
    Regards,
    -Gustavo Medina

  • Unable to use proxy server with MAC OS X Anyconnect client

    Hi All,
    I have a VPN setup thru a Cisco 5520, Windows clients connect just find and the end users configure there browser to use our internal proxy servers.   Users with the MAC OS X Anyconnect client can connect, they configure their Mac to use our proxy server, but the broswers will not work, clients can reach networks and resources behind the VPN gateway and have access to the Proxy(Tried a telnet to that hostname/port).  Anyone run into this issue before?  I am running ASA 8.3(2), Anyconnect(OS X) 3.1.01065.
    Thank You

    We had the same problem.
    We are behind government firewall so I don't know which Cisco firewall is used but we are using AnyConnect to establish VPN from internet to LAN behind firewall. We have no problems with Windows. With Mac OS X connection through proxy didn't work with Safari and Chrome (both are using system Proxy setting), but it did work with Firefox (which has it's own Proxy).
    Finally we found out that ethernet MTU size was the culprit. When we set it to manual, with size being 1347 (or less), proxy started to work.

  • SSL Certificate Mismatch with AnyConnect client

    Hello,
    We are having a problem with the AnyConnect client when connecting to our VPN.  We are running the following:
    AnyConnect v2.4.0202
    (2 each) ASA v8.2(1) -- active/standby failover
    AnyConnect Essentials Licensing
    NOTE:  We are not using certificates for authentication.
    Primary clients:  Windows XP and Windows 7
    Problem
    We have purchased an Entrust certificate for our ASA failover cluster called "vpn.company.com" and the it is attached to the outside interface on the ASA.
    Steps to Reproduce
    Install the AnyConnect (AC) client via https://vpn.company.com/.  Connection occurs here without issue.
    Once the AC client is installed and we try to use it in stand-alone mode (i.e., w/o hitting the ASA w/ a browser), a certificate mismatch occurs, and AC brings up the Windows/IE Security Alert dialog (see attachment CertError.jpg).
    The user must press Yes to bypass mismatch.
    PROBLEM:  On Windows 7, the user must have administrative privileges and run the AC client as administrator -- otherwise, they get a dialog saying "Unable to establich VPN" (see attachment Unable.jpg).
    The issue is we have a valid certificate that should be used for the connection.  However, when looking at the connections made by the AC client with Fiddler, it would appear that the AC client is trying to connect directly to the ASA's IP address, and not the name.  This is a nuisance for XP users, and a show-stopper for Win7 users as they do not have admin privileges.
    I have not been able to find any documentation on Cisco.com relating to this issue.  In short, how do I get the AC client to use "vpn.company.com" so there is no Cert mismatch?
    Thanks,
    -Matt

    Tim,
    I will read through the article more thoroughly; I've already been through parts of it -- won't hurt to go through again.  I did initially have the IP address in my XML file, and immediately removed it when I noticed that it was using the IP address in the FIddler dump.  It hasn't had any effect unfortunately -- even with uninstalling and re-installing the AC client locally.
    The only other article/post I've come across on Cisco's site that comes close is here:
    Cisco Support Community: ASA VPN Load Balancing/Clustering with Digital Certificates Deployment Guide
    which seems to suggest that I will need a UCC certificate (which seems ridiculous) to do some of what I need to do.  However the issue with that post is that it still wouldn't fix the issue where the AC client is using the IP address.
    I will let you know if I find any smoking guns in the doco link you sent.  Any other thoughts appreciated.  I can't believe Cisco made the setup of the AC client this convoluted.
    Thanks!
    -Matt

  • AnyConnect Client v3.1 driver error on windows 7

    Hello,
    I used AnyConnect Client v3.0 on my windows 7 machine and worked well. But after automatic upgrade to v3.1 by the VPN server(ASA) and it does not work any more. It seems that VPN authentication is successful but activation of VPN adapter fails.
    I see two error messages below:
    The VPN client driver has encountered an error. Please restart your computer or device, then try again.
    AnyConnect was not able to establish a connection to the specified secure gateway. Please try connecting again.
    Message History:
    [30/08/2013 6:03:14 PM] Ready to connect.
    [30/08/2013 6:04:20 PM] Contacting vpn.example.com.
    [30/08/2013 6:04:25 PM] User credentials entered.
    [30/08/2013 6:04:26 PM] Establishing VPN session...
    [30/08/2013 6:04:26 PM] Checking for profile updates...
    [30/08/2013 6:04:26 PM] Checking for product updates...
    [30/08/2013 6:04:26 PM] Checking for customization updates...
    [30/08/2013 6:04:26 PM] Performing any required updates...
    [30/08/2013 6:04:32 PM] Establishing VPN session...
    [30/08/2013 6:04:32 PM] Establishing VPN - Initiating connection...
    [30/08/2013 6:04:33 PM] Establishing VPN - Examining system...
    [30/08/2013 6:04:33 PM] Establishing VPN - Activating VPN adapter...
    [30/08/2013 6:05:13 PM] Establishing VPN - Repairing VPN adapter...
    [30/08/2013 6:06:00 PM] Disconnect in progress, please wait...
    [30/08/2013 6:11:53 PM] Connection attempt has failed.
    [30/08/2013 6:11:54 PM] Ready to connect.
    I already did most of suggestions below from google but still the issue has not been resolved.
    - Rebooted the laptop
    - Confirm ICS disabled
    - Remove Anyconnect client from the laptop and reinstall
    - http://www.lehigh.edu/~inlts/comp/docs/vpn/cisco-drvr.html
    Cheers
    Jeong

    I am also facing the exact same issue. I even tried with the newer version. But it does not work. During connection, it asks for accepting the banner and the suddenly the cisco adapter driver gets uninstalled from device manager and cisco pops-up the error screen.
    " the VPN client driver encountered an error. Please restart your computer or device and try again"
    Please help.

  • AnyConnect - client XML

    hi all,
    one of request made by my customer was to automate the AnyConnect cline to use the LocalLAN access per xml profile.
    at the moment it works if he activate it manually. he is trying to achieve this automatically via the XML profile so that the client doesn't have to make this manually. on the XML profile I can see this is been enabled 
    <LocalLanAccess UserControllable="false">true</LocalLanAccess>
    however, when connected this is been ignored by the client for some reason.
    they have several settings in the XML-Profile which are working fine without any problem, so the configuration file itself is used by the AnyConnect client. Only the Local LAN setting is ignored.
    they are currently using the 3.1.02026 and also tested with 3.1.02040 both version are behaving the same way as discribe above.
    any help on this please?
    thanks in advance
    Lancellot

    Hi Ciscomax,
    thanks for the reply
    this is the group policy
    group-policy POLICY1 attributes
    dns-server value xxx.xxx.xxx.xxx yyy.yyy.yyy.yyy
    dhcp-network-scope aaa.aaa.aaa.aaa
    vpn-tunnel-protocol ssl-client
    split-tunnel-policy excludespecified
    split-tunnel-network-list value KKKKKKK
    default-domain value reh.rehau.de
    msie-proxy method no-modify
    msie-proxy pac-url value http://mmmmmm.com
    msie-proxy lockdown disable
    webvpn
      anyconnect modules value dart,posture
    access-list KKKKKK standard permit host 0.0.0.0
    just an update, if you enable this manually it works. so my customer is trying to automate this.
    thanks in advance
    Lance

Maybe you are looking for

  • Bad surprises with fonts

    Hallo NG, I have an application of several front panels. Trying to give all these panels a uniform "Look and feel" (There's nothing more unprofessional than a application where fonts change from window to window) I declared some default fonts especia

  • Deleting a Material

    HI Guys, Besides setting the deletion flag for the material in the material master. Is there a setting that i can use to block the user from displaying the material in the Sales ordeR?

  • Quality of some images degrading on export

    A customer of ours created a PDF from Indesign CS4 6.0.5 using our custom PDF export presets and noticed that the quality of some of her images degraded or became pixilated jagged however the resolution did not change. They checked the original image

  • Attachments of .zip Xcode projects blocked.

    A friend has been trying to send .zip Xcode projects to me, as attachments, to my iCloud email account. Despite upgrading my storage, they're always blocked, and bounce back to him, forcing him to send them to my gmail account. I'd like to receive th

  • Windows Update Fails After fresh install

    All, Complete new installation of Windows 7 Pro on a X200 Tablet version.  All ok, able to run all MS updates without any problems.  After installing Lenovo System update and running the actual updates, I suddenly can't run Microsoft Update any longe