Anyconnect Issue

I tried setting up the SSL VPN using anyconnect. I can get to the webpage and authenticate, it downloads and installs the client. When the client trys to connect I run into trouble and recieve the following error:
an error was received from the secure gateway in response to the VPN negotiation request. Please contact your network administrator. The following message was received from the remote VPN device: No assigned address
Has anyone seen this or have any idea what would cause it.
I am not sure what address it is refering to, if it is IP address there is a pool configured on the ASA and it is configured in the

Are you getting the error on one user only or anyone connecting to webvpn.
WebVPN is also treated as a different tunnel group and yes it should have its own IP local POOL of its own just as the regular RA tunnel group does have.
Also, what version of ASA are you running, and what type of client OS is the user using is it vista?
Rgds
-Jorge

Similar Messages

Weird AnyConnect Issues - How to diagnose?

Hi VPN Experts, I've recently moved a large (well, to me large) number of users to Cisco VPN using an ASA 5540 and AnyConnect. This group of users, (around 250) are all successful with two exceptions, and they are weird issues.
One user, connects just fine, can access all resources, but when running SAP, even though inactive in SAP but active in other VPN traffic, she periodically (randomly) disconnects from SAP, with the error of failed network connection. We have verified this does not happen on the old VPN, and we've timed it carefully, and the timing is random (sometimes 12 minutes, sometimes 63 minutes and everything in between). We've diagnosed and re-installed everything on her machine, yet this continues to happen. There are no disconnects on the VPN client, which would indicate an ISP problem, and I'm really stumped on what to try on this one... any ideas?
The other is possibly an ISP problem, but we're seeing one customer who uses the Cisco VPN and has frequent random disconnects, when the disconnect occurs he cannot access any network resources. He did not see this behavior with the old VPN client (AT&T) but this could be indicative of a sensitive ISP connection, do you agree? I'm thinking his internet connection has minor drops, and the Cisco client is very sensitive to it... it will reconnect but is there a way to lower the sensitivity to dropped packets a little for him? Or is this a universal setting?
Thanks in advance,
Ken Montgomery

Ken,
For first problem, you need a sniffer trace.
SAP used to rely on TCP keepalives to see which session are active or not.
There were some odd scenarios in which some devices would stupid responding to keeplaives "after some time"
vide:
http://www-01.ibm.com/support/docview.wss?uid=isg1IY89429
Now to be honest I'm not aware of how changing client can cause this, but I would look at network level - see what's happening during disconnect, maybe it's just a question of disabling something or insreasing timers. Hard to say without more data ;]
It would be also good to know whether you're using SSL or DTLS.
2nd - Our VPN clients, be it anyconnect or old VPN client, are using DPDs so yes it could be that client could be affected more. For AC, You can try relaxing DPD and keepalive timers on ASA.
http://www.cisco.com/en/US/docs/security/asa/asa90/command/reference/a2.html#wp1748502
http://www.cisco.com/en/US/docs/security/asa/asa90/command/reference/a2.html#wp1821618
However the defaults are very decent, hardly anybody needs to adjust them.
Maybe it's something to be evaluated by ISP?

AnyConnect issue with Cisco ASA 5505

I continue to bang my head against the wall on this one. Everytime I try to connect to the AnyConnect SSL VPN I get the following error
"No address available for SVC connection"
I have verified up and down that my VPN pool is there and assigned. I have deleted/re-added this so many times. I am using the ADSM to set this up via the wizard. Any help please?
Here is my config
http://pastebin.com/ABvSpzUq

It seems like you are falling into the default group policy. You need to either enable tunnel-group-list under the webvpn which allows users to select the group they are connecting to, or configure user attributes to force that user into the correct connection profile..
enabling tunnel-group-list
webvpn
tunnel-group-list enable
configuring user attributes:
username Chris password mXB.dKavHoEa0gaC encrypted
username Chris attributes
vpn-group-policy HBNS_AnyConnect
group-lock value HBNS_AnyConnect
service-type remote-access
Please remember to select a correct answer and rate

Anyconnect created profile not shown in connection list, especially the wireless profiles.

Dears,
Kindly advise as we encounter anyConnect issue, when creating profile for using with ISE, the new created profile is not shown in the connection list.
I’m using profile editor to create profile for EAP-Fast, the issue is that the profile that was created not shown in the connection list.
i put the xml file in the correct location
C:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client\Network Access Manager\newConfigFiles
in windows 7.
it is shown in saved networks but not shown in the connection list.
we tried profile editor version 4 but the same issue still exist.

Hi,
Test the System Connector Type in the Portal.
Connector should be any one of the Types :JDBC, ODBO, XMLA, OLAP then only the BI systems will be appear in the BI integartion wizard,
Govindu

AnyConnect and Windows 8.1 Update issue

I have an ISA550W deployed at our office locations. For remote access I am testing AnyConnect v3.1.05187. The laptops I'm testing on have Windows 8.1 Pro Update with all of the latest patches as of this post.
I read the release notes and as a consequence made sure WinPcap is not installed and the service non-existent.
I have run the MicrosoftFixit25005.
When I installed AnyConnect I unchecked the options for "Diagnostic and Reporting Tool", "Network Access Manager", & "Web Security".
Here is the problem; upon initial install it works flawlessly even without a reboot after running the installer. BUT if the OS is rebooted, it gives the following error: "The service provider in your current location is restricting access to the internet. You need to log on with the service provider before you can establish a VPN session. You can try this by visiting any website with your browser."
Bollox! lol.
Now I can confirm that sometimes it takes a couple reboots or even until the next day for it to be broken. But all I have to do is uninstall everything, reinstall it and it works, all with no reboot after uninstall or reinstall.
So why does this thing just decide to break its self?

Anyone have any ideas? This is a major pain to everyone in our company that works remotely.
Perhaps someone could even just walk me thru how to produce a log to post here that may help, although I doubt it since I can't predict on which reboot it will break.
Surely someone else has had this issue or there is a known resolution for it? Please help!
Thanks! Alex

Windows 8 64 bit issues with Cisco AnyConnect Secure Mobility Client version 3.1.04072

I am having an issue with the Cisco AnyConnect Secure Mobility Client version 3.1.04072 on a Windows 8 64 bit laptop.
I am able to create the VPN connection but the connection will not allow data to be transferred.
Stats from a manual connection:
Cisco AnyConnect Secure Mobility Client Version 3.1.04072
VPN Stats
    Bytes Received: 14375
    Bytes Sent: 0
    Compressed Bytes Received: 0
    Compressed Bytes Sent: 0
    Compressed Packets Received: 0
    Compressed Packets Sent: 0
    Control Bytes Received: 0
    Control Bytes Sent: 0
    Control Packets Received: 0
    Control Packets Sent: 0
    Encrypted Bytes Received: 7820
    Encrypted Bytes Sent: 1207
    Encrypted Packets Received: 9
    Encrypted Packets Sent: 3
    Inbound Bypassed Packets: 0
    Inbound Discarded Packets: 0
    Outbound Bypassed Packets: 0
    Outbound Discarded Packets: 0
    Packets Received: 4
    Packets Sent: 0
    Time Connected: 00:03:01
Protocol Info
    Inactive Protocol
        Protocol Cipher: RSA_3DES_168_SHA1
        Protocol Compression: None
        Protocol State: Disconnected
        Protocol: DTLS
    Active Protocol
        Protocol Cipher: RSA_3DES_168_SHA1
        Protocol Compression: Deflate
        Protocol State: Connected
        Protocol: TLS
OS Version
    Windows 8 : WinNT 6.2.9200
Log from the data transmission software:
24/12/2013 12:51:13 - Application version = 1.11.28.0
24/12/2013 12:51:13 - Lodgement Library Version = 1.11.28.0
24/12/2013 12:51:13 - Connection Method = INTERNET
24/12/2013 12:51:13 - DIS Connection Type = Automatic
24/12/2013 12:51:13 - VPN Client = ACTIVE
24/12/2013 12:51:13 - Check Available Connections = NOT ACTIVE
24/12/2013 12:51:13 - Windows 8 (6.2.9200 SP )
24/12/2013 12:51:13 - Language: English (Australia)
24/12/2013 12:51:13 -
24/12/2013 12:51:13 - Connected to ISP via LAN
24/12/2013 12:51:13 - Checking for presence of VPN client.
24/12/2013 12:51:13 - VPN client found. (C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpncli.exe)
24/12/2013 12:51:13 - The Cisco AnyConnect Secure Mobility Client application is in use.
24/12/2013 12:51:18 - Terminating Cisco AnyConnect Secure Mobility Client in progress ...
24/12/2013 12:51:18 -
24/12/2013 12:51:18 - Checking Cisco AnyConnect version.
24/12/2013 12:51:19 - Cisco AnyConnect Secure Mobility Client (version 3.1.04072) .
24/12/2013 12:51:19 - Copyright (c) 2004 - 2013 Cisco Systems, Inc. All Rights Reserved.
24/12/2013 12:51:19 - Config file directory:C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\
24/12/2013 12:51:19 -
24/12/2013 12:51:19 - Loading profile:C:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client\Profile\ELS-IMelAde-TCP.xml
24/12/2013 12:51:19 -
24/12/2013 12:51:19 - Initializing the VPN connection.
24/12/2013 12:51:19 - Ready to connect.
24/12/2013 12:51:19 - Ready to connect.
24/12/2013 12:51:19 - Contacting ELS-IMelAde-TCP.
24/12/2013 12:51:23 - Authenticating user.
24/12/2013 12:51:23 - Connected to VPN concentrator.
24/12/2013 12:51:23 - Establishing VPN session...
24/12/2013 12:51:23 - Checking for profile updates...
24/12/2013 12:51:23 - Checking for product updates...
24/12/2013 12:51:23 - Checking for customization updates...
24/12/2013 12:51:23 - Performing any required updates...
24/12/2013 12:51:23 - Establishing VPN session...
24/12/2013 12:51:23 - Establishing VPN - Initiating connection...
24/12/2013 12:51:24 - Establishing VPN - Examining system...
24/12/2013 12:51:24 - Establishing VPN - Activating VPN adapter...
24/12/2013 12:51:24 - Establishing VPN - Configuring system...
24/12/2013 12:51:24 - Establishing VPN...
24/12/2013 12:51:24 - Connected to VPN concentrator.
24/12/2013 12:51:24 - Connected to ELS-IMelAde-TCP.
24/12/2013 12:51:24 - Connected to VPN concentrator.
24/12/2013 12:51:24 - Connection to VPN client return code = 0.
24/12/2013 12:51:24 - Connected to VPN concentrator.
24/12/2013 12:51:24 - Connecting : Connecting to 203.202.43.2.
24/12/2013 12:51:45 - Error in ConnectToDIS - Socket Error # 10060
Connection timed out.
24/12/2013 12:51:46 -
24/12/2013 12:51:46 - Disconnecting from the VPN concentrator.
24/12/2013 12:51:46 - Disconnect in progress, please wait...
24/12/2013 12:51:46 - Detaching AnyConnect, please wait...
24/12/2013 12:51:47 - Detached.
24/12/2013 12:51:47 - Disconnected from VPN concentrator.
24/12/2013 12:51:47 - *****************************************************
24/12/2013 12:51:47 -               END OF LODGEMENT PROCESS
24/12/2013 12:51:47 - *****************************************************
Issue history:
- Previously running Cisco VPN client on Windows 8 64 bit laptop (VPN working and able to transmit data over VPN)
- Upgrade to Windows 8.1 stopped the VPN client working
- Refreshed system back to Windows 8 and reinstalled all software
- Cisco VPN client would not install on system
- Cisco AnyConnect Secure Mobility Client installs and is able to connect to VPN host
- Cisco AnyConnect Secure Mobility Client downloads and installs software from VPN host
- Data transmission software returns error code #10060
Any assistance would be greatly appreciated.

anyone found the fix for this?

Anyconnect VPN via IPSec - Certificate issue

Hi,
I'm currently setting up a VPN-firewall and ran into problems with the certificates. I only want to enable IPSec connections via Anyconnect to the firewall. The client and the profile will be rolled out manually, so there is no need for anything web-based (portal, web-installer, SSL, etc.).
The VPN-firewall is reached through the normal outside-firewall (NAT) via FQDN (vpn.abc.com).
The normal setup is finished, but I have problems regarding the certificate. First I generated a CSR with "cn=fw001.abc.com", installed, bound to interface - but when I try to connect, I get the certificate error ("cert doesn't match server name" and "ca not trusted"). Then I tried a new CSR with "cn=vpn.abc.com", but it's still the same. Tomorrow I will try to get the CA-certificate to get rid of the "ca not trusted" message, but this one with the server name will still remain.
I mean, the connection works, but it's this popup-window with the certificate warning that bothers me.
I already had a similar configuration on another site, but there I had a wildcard certificate (*.xyz.com), which I installed as identity certificate and it worked properly.
Questions:
1.) Does anybody know what could be the issue here?
2.) Do I need a certificate on the outside firewall?
Thanks in advance!

Thanks for the response.
First of all I need to state once again that I get 2 warnings:
1.) Certificate does not match the server name.
2.) Certificate is from an untrusted source.
I know the procedure regarding certificates, I generated a request and got the proper signed licence, but the issue is the "server name not matching"-message. I created the CSR with the CN=vpn.abc.com, and got it signed with this CN. In the connection profile, the tunnel destination is also set to the domain and not the IP:
"<HostAddress>vpn.abc.com</HostAddress>"
But nevertheless, I get the message that the certificate doesn't match the server name.
I'm aware that the CA must be trusted on the PC, but this explains only the second message (untrusted) and not the mismatching name.
Like I said I also tried it with CN=hostname.abc.com and sent the CSR to the signing, but it was the same issue. What name must I use so that the first message isn't showing up?

Anyconnect XML Profile Certificate Matching - Multiple Certs different Issuer

Hi Guys
I am trying to setup an xml profile for cisco anyconnect that will look at multiple certificates that could be issued from 2 different CA's.....
Currently having trouble setting this up and it does not look like it is possible..
Is there a way around this?
Regards
Mohamed

The AnyConnect client supports the following certificate match types. Some or all of these may be used for client certificate matching. Certificate matching are global criteria that can be set in an AnyConnect profile. The criteria are:
â¢Key Usage
â¢Extended Key Usage
â¢Distinguished Name
http://www.cisco.com/en/US/docs/security/vpn_client/anyconnect/anyconnect20/administrative/guide/admin7.html#wp1000158

AnyConnect disconnect issue

Hello,
Any help or insight is appreciated.
Running ASA 5505 (8.4.6) with AnyConnect 3.1.03103 for Windows.
VPN sometimes connects and sometimes do not. When the connection does not work, get the following message:
"Connection attempt has timed out. Please verify Internet connectivity."
Cisco Secure Mobility 3.1 User error messages state the following..
" Description AnyConnect canceled the connection attempt because the wait for a response exceeded an internal time-out value.
Recommended User Response Try a new VPN connection."
Try 4 consective VPN attempts and 1 of the 4 will work.
Upgraded ASA and AVC to latest, as noted above, and still having intermittent issues. Issue is only with Windows 7 - 64bit systems.
VPN works just fine on MAC systems.
Any ideas or thoughts is appreciated.
Paul

Paul,
Are you facing the issue with wireless or wired link? Try to upgrade the drivers of the network adapter you are using to connect anyconnect. Also Can you take dart logs from the windows 7 machine? Below is the link to how to take dart logs :
http://www.cisco.com/en/US/docs/security/vpn_client/anyconnect/anyconnect31/administration/guide/ac13managemonitortbs.html#wp1058628
Dart logs will enable us to see the issue you are facing with your machine.
Regards,
Varinder
P.S. Please mark this post as 'Answered' if you find the above information helpful so that it brings goodness to other community users

VPN issues after updating to Cisco AnyConnect 3.1.04072?

Even after downloading the most recent version of Cisco Client 3.1.04072 (see below) I'm still getting a periodic disconnect and reconnect from my VPN client. Issue only seems to occur when I'm connecting from outside my company's wi-fi network. Happens on both my personal and on public wi-fi. Is anyone else experiencing a similar issue?
Changes in AnyConnect 3.1.04072 (and 3.1.04074)
The Mac OS X versions of AnyConnect were updated to 3.1.04074 to resolve the problem of frequent disconnects of the AnyConnect VPN on systems running Mac OS X 10.9 (Mavericks). Apple is aware of this issue and you can reference Apple Bug Report ID 15261749 if you want to open your own case with them. AnyConnect 3.1.0474 also supports Mac OS X 10.8, 10.7 and 10.6.
Once Apple provides a fix for OS X 10.9, we may choose to retract this workaround. At that time, both versions 3.1.04074 and 3.1.04072 of AnyConnect will work reliably with Mac OS X 10.9.
Defect CSCui69769 was fixed by version 3.1.0704.
AnyConnect 3.1.04072 is a maintenance release that resolves the defects described in Caveats Resolved by AnyConnect 3.1.04072 and is compatible with Host Scan Engine Update, 3.1.04075.

Pete is right, I apparently don't know how to read version numbers! I downloaded the 3.1.05152 version of Cisco AnyConnect, and I no longer experience the reconnect issue on Mavericks. Yea!
In my defense, there is no such version 3.1.04074 listed on the download page:
http://software.cisco.com/portal/pub/download/portal/select.html?&mdfid=28300018 5&flowid=17001&softwareid=282364313
So I mistakenly downloaded 3.1.04072 in a moment of dyslexia. I suspect I'm not the first person to come along and do this!
PS: You need a service contract with Cisco to download this file. If you don't have one, and/or your IT administrator isn't able to provide you with one, you might try doing a google search for the actual filename: anyconnect-macosx-i386-3.1.05152-k9.dmg. If you go this route, at least compare the md5 checksum with the one listed on Cisco's website (it shows up if you hover your cursor over the file) to ensure you're not running a hacked VPN client. For example, running "md5 anyconnect-macosx-i386-3.1.05152-k9.dmg" should produce a884f2092d08f006b2dc3a5054988f1c. If it does not, it's not the same binary as on Cisco's downloads page so you probably don't want to run it.

Anyconnect 2.5 and 3.1 on C1841 - Sequence issues

Hi All,
I have been trying to get this right for a while now and can't find documentation or anyone having the same issue, so probably I'm missing something.
Here is the issue: Some clients are using Anyconnect 2.5 due to OS requirements and some other running on Win8 need to connect using Anyconnect 3.1
This is working fine at the moment with the following swquence numbers
#sh run | in install
webvpn install svc flash:/webvpn/anyconnect-win-2.5.3046-k9.pkg sequence 1
webvpn install svc flash:/webvpn/anyconnect-win-3.1.05152-k9.pkg sequence 2
webvpn install svc flash:/webvpn/anyconnect-macosx-i386-3.1.05152-k9.pkg sequence 3
webvpn install svc flash:/webvpn/anyconnect-macosx-i386-2.5.6005-k9.pkg sequence 4
Now if I change the sequence number for 3.1 to be preferred
#sh run | in install
webvpn install svc flash:/webvpn/anyconnect-win-3.1.05152-k9.pkg sequence 1
webvpn install svc flash:/webvpn/anyconnect-win-2.5.3046-k9.pkg sequence 2
webvpn install svc flash:/webvpn/anyconnect-macosx-i386-3.1.05152-k9.pkg sequence 3
webvpn install svc flash:/webvpn/anyconnect-macosx-i386-2.5.6005-k9.pkg sequence 4
users running 2.5 are no longer able to connect to the VPN and the following error shows up
Is there a limitation I am not aware of?
Thank you

AnyConnect 3.1 is a significant upgrade, even over 3.0.
Over 3.0 it adds an enhanced GUI (common between Windows and Mac), NAM enhancement, crypto suite B enhancements, HostScan/Posture performance enhancements, IPv6 support, better untrusted certificate handling, plug-in component tiles, etc.
3.0+ offers IPSec VPN client as opposed to SSL VPN.

AnyConnect 3.1.00495 on Mac - CSD Issues

Hey all,
I recently upgraded the image files in our ASA 5510 (v 8.2) for the newest AnyConnect clients for Mac and Windows. I also uploaded the proper csd and hostscan images.
Package files used:
csd_3.6.6203-k9.pkg
hostscan_3.0.08066-k9.pkg
anyconnect-win-3.1.00495-k9.pkg
anyconnect-macosx-i386-3.1.00495-k9.pkg
I perfomed this two weeks ago, and both mac and win clients have been working fine. Yesterday, I configured the AnyConnect Client Profile for auto-reconnect, and removed the old 2.X client images.
Today, mac clients are having trouble connecting. The errors are attached.
It appears the mac client is having difficulty downloading and running the CSD.
Mac is running latest version of Mac OS X Mountain Lion.
Any Ideas?

I solved the issue by just rebuilding my Mac from scratch

Anyconnect Profile Issue

Hello,
I have 2 asa firewall in HA where I have created any-connect vpn profile for end users
All users profile are stored in flash as well as anyconnect client image
Suddenly due to some reason I need to shutdown my primary firewall
All things works good, secondary firewall came up,but no any connect user are able to connect their profile
When I see in ASA there are no profiles available in flash which I created in primary firewall
Its seems veired to me as both firewall config must be synced,..
Cn anyone help us what was the issue
or Should I need to create profile on both the firewall

AnyConnect profiles (and a few other things) are not automatically synchronized between ASAs in a failover pair. I'm not sure why Cisco has never fixed this but it's been a documented bug for quite some time.
You need to copy the files manually. They are small xml files and usually not too hard to copy.
If you've lost the primary unit altogether, you will need to recreate the profiles on the secondary active unit.

AnyConnect, EAP-TLS, Certificate Store Issue

Morning All,
I've got a customer that wants to deploy AnyConnect for their new EAP-TLS based WLAN. We can get the service working perfectly using the windows 7 supplicant. The problems start when using AnyConnect.
When we create a profile with certificate store set to all in the profile editor, we get an error along the lines of no valid certificate found. This seems a bit crazy considering the windows supplicant can both find and use it.
Any ideas?
Cheers,
N

Hi Salod,
I now believe it to be an AD permission issue with regard to the cert stores. I have lab'd this and have got both user and machine certs working through the anyconnect client.
Regards,
Nick

AnyConnect SSL Client issue with Mac OS X

Hello this seems to be a very common issue with AnyConnect working on Mac OS X. A lot of random sites talk about this.
I have a Cisco 2801 running IOS 12.4(22)T (ADV ENT SRV) with AnyConnect 2.3 package installed.
From Windows I can connect without any issues.
From a Mac OS X after providing login credentials the AnyConnect log says its connecting... checking for updates... and then disconnects.
If this does work on Mac OS X what is needed (or needs to be configured) to get this to work properly on Mac OS X?
Thank you!

Hello All,
I recently experienced the same problem when my company upgraded to our entire company from the stone age to a VPN system using the Cisco AnyConnect. At first, I had the same problem as described above. Then my IT guy and I got on the phone with Cisco.
Here is the solution that worked for me. First, our IT department had to specifically load a MAC connection file into the VPN firewall to allow access for MacIntosh computers. Then I redownloaded the latest anyconnect files and updated whatever else through the vpn.yourcompany.com site. Finally, from www.citrix.com/download I downloaded (on the RH side under featured downloads) the appropriate Citrix ICA File.
Everything works fine now. I don't know if this will work for you, but it did the trick for us.

Anyconnect Issue

Similar Messages

Maybe you are looking for