Getting AnyConnect to work on demand on the iPhone

I've got certificate based authentication working on the iPhone with AnyConnect and my ASA. Now I need to get the on demand function to work. AnyConnect is configured to use certificates, the certificate is selected and connect on demand is turned on. I have my internal domain added to always connect. As a test I'm trying to access one of the web servers in the domain via Safari on the iPhone. It appears to recognize that the VPN is needed, but I get the message "The VPN connection requires an application to start up." My only option is to tap OK and then I get the Safari can't open page message. Using a ping tool, it never tries to initiate the VPN.

Hi,
In the authentication in the ASA CA server I using Manual certificate Retrieval,
I Atacched the logs of "debug crypto ca 255"
thank for you help
%ASA-6-725001: Starting SSL handshake with client outside:189.253.X:X/2219 for TLSv1 session.
%ASA-7-725010: Device supports the following 4 cipher(s).
%ASA-7-725011: Cipher[1] : RC4-SHA
%ASA-7-725011: Cipher[2] : AES128-SHA
%ASA-7-725011: Cipher[3] : AES256-SHA
%ASA-7-725011: Cipher[4] : DES-CBC3-SHA
%ASA-7-725008: SSL client outside:189.253.X.X/2219 proposes the following 6 cipher(s).
%ASA-7-725011: Cipher[1] : RC4-MD5
%ASA-7-725011: Cipher[2] : RC4-SHA
%ASA-7-725011: Cipher[3] : DES-CBC-SHA
%ASA-7-725011: Cipher[4] : DES-CBC3-SHA
%ASA-7-725011: Cipher[5] : AES128-SHA
%ASA-7-725011: Cipher[6] : AES256-SHA
%ASA-7-725012: Device chooses cipher : RC4-SHA for the SSL session with client outside:189.253.X.X/2219
%ASA-7-725014: SSL lib error. Function: SSL3_READ_BYTES Reason: sslv3 alert certificate unknown
%ASA-6-725006: Device failed SSL handshake with client outside:189.253.X.X/2219
%ASA-7-710005: TCP request discarded from 189.253.X.X/2219 to outside:200.57.X.X/443
%ASA-6-725001: Starting SSL handshake with client outside:189.253.X.X/50445 for TLSv1 session.
%ASA-7-725010: Device supports the following 4 cipher(s).
%ASA-7-725011: Cipher[1] : RC4-SHA
%ASA-7-725011: Cipher[2] : AES128-SHA
%ASA-7-725011: Cipher[3] : AES256-SHA
%ASA-7-725011: Cipher[4] : DES-CBC3-SHA
%ASA-7-725008: SSL client outside:189.253.X.X/50445 proposes the following 6 cipher(s).
%ASA-7-725011: Cipher[1] : RC4-MD5
%ASA-7-725011: Cipher[2] : RC4-SHA
%ASA-7-725011: Cipher[3] : DES-CBC-SHA
%ASA-7-725011: Cipher[4] : DES-CBC3-SHA
%ASA-7-725011: Cipher[5] : AES128-SHA
%ASA-7-725011: Cipher[6] : AES256-SHA
%ASA-7-725012: Device chooses cipher : RC4-SHA for the SSL session with client outside:189.253.X.X/50445
%ASA-7-717025: Validating certificate chain containing 1 certificate(s).
%ASA-7-717029: Identified client certificate within certificate chain. serial number: 0F, subject name: cn=acruz.
%ASA-7-717030: Found a suitable trustpoint LOCAL-CA-SERVER to validate certificate.
%ASA-6-717022: Certificate was successfully validated. serial number: 0F, subject name: cn=acruz.
%ASA-6-717028: Certificate chain was successfully validated with warning, revocation status was not checked.
CERT API thread wakes up!
CRYPTO_PKI: Checking to see if an identical cert is
already in the database...
%ASA-6-725002: Device completed SSL handshake with client outside:189.253.X.X/50445
CRYPTO_PKI: looking for cert in handle=3d4a45b8, digest=
94 e1 e9 61 b2 59 1c 72 74 22 96 ed d6 65 82 8e | ...a
CRYPTO_PKI: Cert record not found, returning E_NOT_FOUND
CRYPTO_PKI: Cert not found in database.
CRYPTO_PKI: Looking for suitable trustpoints...
CRYPTO_PKI: Storage context locked by thread CERT API
CRYPTO_PKI: Found a suitable authenticated trustpoint LOCAL-CA-SERVER.
CRYPTO_PKI(make trustedCerts list)CRYPTO_PKI:check_key_usage: ExtendedKeyUsage extension not found.
CRYPTO_PKI:check_key_usage:Key Usage check OK
CRYPTO_PKI: Certificate validation: Successful, status: 0. Attempting to retrieve revocation status if necessary
CRYPTO_PKI:Certificate validated. serial number: 0F, subject name: cn=acruz.
CRYPTO_PKI: Storage context released by thread CERT API
CRYPTO_PKI: Certificate validated without revocation checkCERT API thread sleeps!
%ASA-7-717036: Looking for a tunnel group match based on certificate maps for peer certificate with serial number: 0F, subject name: cn=acruz, issuer_name: cn=mobile.domain.com.
%ASA-4-717037: Tunnel group search using certificate maps failed for peer certificate: serial number: 0F, subject name: cn=acruz, issuer_name: cn=mobile.domain.com.
CRYPTO_PKI: Attempting to find tunnel group for cert with serial number: 0F, subject name: cn=acruz, issuer_name: cn=mobile.domain.com.
CRYPTO_PKI: No Tunnel Group Match for peer certificate.
%ASA-6-725007: SSL session with client outside:189.253.X.X/50445 terminated.
%ASA-6-725001: Starting SSL handshake with client outside:189.253.X.X/1381 for TLSv1 session.
%ASA-7-725010: Device supports the following 4 cipher(s).
%ASA-7-725011: Cipher[1] : RC4-SHA
%ASA-7-725011: Cipher[2] : AES128-SHA
%ASA-7-725011: Cipher[3] : AES256-SHA
%ASA-7-725011: Cipher[4] : DES-CBC3-SHA
%ASA-7-725008: SSL client outside:189.253.X.X/1381 proposes the following 6 cipher(s).
%ASA-7-725011: Cipher[1] : RC4-MD5
%ASA-7-725011: Cipher[2] : RC4-SHA
%ASA-7-725011: Cipher[3] : DES-CBC-SHA
%ASA-7-725011: Cipher[4] : DES-CBC3-SHA
%ASA-7-725011: Cipher[5] : AES128-SHA
%ASA-7-725011: Cipher[6] : AES256-SHA
%ASA-7-725012: Device chooses cipher : RC4-SHA for the SSL session with client outside:189.253.X.X/1381
CERT API thread wakes up!
%ASA-7-717025: Validating certificate chain containing 1 certificate(s).
%ASA-7-717029: Identified client certificate within certificate chain. serial number: 0F, subject name: cn=acruz.
%ASA-7-717030: Found a suitable trustpoint LOCAL-CA-SERVER to validate certificate.
%ASA-6-717022: Certificate was successfully validated. serial number: 0F, subject name: cn=acruz.
%ASA-6-717028: Certificate chain was successfully validated with warning, revocation status was not checked.
%ASA-6-725002: Device completed SSL handshake with client outside:189.253.X.X/1381
CRYPTO_PKI: Checking to see if an identical cert is
already in the database...
%ASA-7-717036: Looking for a tunnel group match based on certificate maps for peer certificate with serial number: 0F, subject name: cn=acruz, issuer_name: cn=mobile.domain.com.
%ASA-4-717037: Tunnel group search using certificate maps failed for peer certificate: serial number: 0F, subject name: cn=acruz, issuer_name: cn=mobile.domain.com.
CRYPTO_PKI: looking for cert in handle=3d4a45b8, digest=
94 e1 e9 61 b2 59 1c 72 74 22 96 ed d6 65 82 8e | ...a
CRYPTO_PKI: Cert record not found, returning E_NOT_FOUND
CRYPTO_PKI: Cert not found in database.
CRYPTO_PKI: Looking for suitable trustpoints...
CRYPTO_PKI: Storage context locked by thread CERT API
CRYPTO_PKI: Found a suitable authenticated trustpoint LOCAL-CA-SERVER.
CRYPTO_PKI(make trustedCerts list)CRYPTO_PKI:check_key_usage: ExtendedKeyUsage extension not found.
CRYPTO_PKI:check_key_usage:Key Usage check OK
CRYPTO_PKI: Certificate validation: Successful, status: 0. Attempting to retrieve revocation status if necessary
CRYPTO_PKI:Certificate validated. serial number: 0F, subject name: cn=acruz.
CRYPTO_PKI: Storage context released by thread CERT API
CRYPTO_PKI: Certificate validated without revocation checkCERT API thread sleeps!
CRYPTO_PKI: Attempting to find tunnel group for cert with serial number: 0F, subject name: cn=acruz, issuer_name: cn=mobile.domain.com.
CRYPTO_PKI: No Tunnel Group Match for peer certificate.
%ASA-6-725007: SSL session with client outside:189.253.X.X/1381 terminated.

Similar Messages

How do I get endnote to work, I have downloaded the plugin but still not available, How do I get endnote to work, I have downloaded the plugin but still not available

Trying to get endnote to work, I have downloaded the required plugin from Apple website but I still can't open endnote or create a list of references etc. I notice on the webpage it says endnote is sold seperately? Can anybody help with this issue?

You have to buy the EndNote application. http://www.endnote.com/
Or are you having problem just to add endnotes or footnotes. Read about it on pages 55-59 in the Pages User Guide. It is downloadable from your Pages Help menu.

TS3694 I performed an iOS 7 software update on my iPhone yesterday, and now the phone is not working at all. The iPhone screen shows to connect to iTunes to restore. I've have done this, and still the iPhone is not working. What going on?

I performed an iOS 7 software update on my iPhone yesterday, and now the phone is not working at all. The iPhone screen shows to connect to iTunes to restore. I've have done this, and still the iPhone is not working. What going on?

I have no idea what may have caused your MacBook to stop working, but from your description it kind of sounds like it may have started before you ran Software Update and installed the new Apps. Just the general slow feeling and bugginess is what tips me off. You said that you weren't sure if you had closed all open windows, that doesn't matter if the computer restarts itself. It automatically closes all other open applications when restarting.
As to your data being retrievable, if when you take it in they do a fresh install of the OS, then no, it will not be unless you want to pay several thousand dollars to a software retrieval company.
I am glad to hear that you have taken into the Apple Store to get it fixed, and that you have all of your purchased music backed up to your iPod. You should be able to just transfer it all back to iTunes once you get your computer back should it be necessary.
As a side note, the proper place for this topic would probably in the MacBook forums, not iTunes since there is no evidence that iTunes started the issue.

I have iphone 6 with ios 8.1.1. The bluetooth pairs with my sony car radio and everything works fine. However, the iphone won't stop searching for other devices.

I have an iPhone 6 with ios 8.1.1 operating system. The Bluetooth pairs with my Sony car radio and works fine. However, the iPhone will not stop searching for other devices. This does not seem to affect anything, but I can't help but think it is using battery power.

One possibility:
How do you know it is searching for other devices? Because you opened Settings > Bluetooth?
Why is it searching for other devices? Because you opened Settings > Bluetooth?

I went to sync my iPhone 4 as usual and when it got to the end stage of the sync where it sync the photos from iPhoto, I get a message pop up that says, "The iPhone cannot be synced. The required file cannot be found." What do I do?

I went to sync my iPhone 4 as usual with my iTunes account on my MacBook Pro and when it got to the end stage of the sync where it syncs with iPhoto, I get a pop up message that says, "The iPhone cannot be synced. The required file cannot be found." What do I do?

Hi. I am having the same problem.
I have updated iPhone software and carrier settings, OSX Lion on the comp and in step 4 of 4 during photo sync about half way through, the error message comes up and now my pics are gone from the phone. I did empty the cache and the problem still persisted. I changed cables, I restored the phone and synced from the back up and even restored and created a new phone identity, still no love.
I am puzzeled, any suggestions?

HT1414 I get a error,(( Itunes could not restore the Iphone on marks Moblie Because the back up was corrupt or not compatible with the iphone that is being restored.)) Help please anyone My pc is Xp is up to date

I had a very larger OTHER folder in itunes, Went and ask Apple rep at shop today and he advised to do a restore but 1st back..
I back up and then did a manual back to make sure it was done.
Then i started iphone restore, all done and now to restore back up.
But i get a error,
""Itunes could not restore the Iphone on marks Moblie Because the back up was corrupt or not compatible with the iphone that is being restored.""
My pc runs XP and software is up to date, checked this before back up.
Disable Anti Virus
Checked itunes is up to date. Ok
Unplug all leeds at back of my pc, except key board & mouse/monitor.
Unpluged Modem.
Did restore again but get same error message,
help please.

Try this -
http://support.apple.com/kb/TS2529
Best of Luck

Can't synch iphone. Get message "synch server failed to synch the iphone. ANyone have any suggestions on how to fix this issue?

Can't synch iphone. Get message "synch server failed to synch the iphone. Anyone have any suggestions on how to fix this issue?
Windows 7
ios 7.1
iphone 5

Hello, skifmli
Thank you for visiting Apple Support Communities.
I understand that you are unable to sync your iPhone and receive an error. I was start with restarting iTunes and your computer. Once this is done, test the results by attempting a sync. If the issue persists, go through the troubleshooting steps in the article below.
Troubleshooting Sync Services on Windows with Microsoft Outlook 2003, Outlook 2007, or Outlook 2010
Cheers,
Jason H.

HT1386 itunes sync takes all music off iphone onto pc. how do i get music from itunes on pc to the iphone?

itunes sync takes all music off iphone 4s onto pc. how do i get music from itunes on pc to the iphone 4s?

Under your device in iTunes, you need to make sure you have "Sync Music" enabled on iTunes under the music tab to tell iTunes to move the music it has over to your iPhone.
Take a look at this article for information on how to sync your iPhone using iTunes.
http://support.apple.com/kb/HT1386

Pogo says my flash player is out dated and i cant get it to work what do i do to get it to work. it says on the computer that i have it

pogo says my flash player is outdated but I can't get it to work. what do I do to get it to work? my computer says that I have the flash player. Help

Hi Christina,
Can you visit this page, click the "Check Now" button and please copy/paste the information shown? That'll help us determine if Flash is running and what browser and operating system is being reported.
Flash Player Help
Thanks,
Chris

How do I get it to work when it has the itunes sign?

How do I get my iPod touch to work when it has the itunes sign on it?

Please read Appendix B.
There have been some problems accessing pages on the Apple web site. If the hyperlink gives you a "We're sorry" message, try again.

Why doesn't the iTunes Apple ID and password work for iCloud on the iPhone 3GS?

I even logged into this Apple Support Community using my Apple ID and password with no problem. It also works in iTunes. But it still doesn't work for iCloud on my iPhone 3GS. It keeps saying "Unsupported Apple ID - iCloud requires an Apple ID that is an email address (including @me.com addresses)" I even put my email address associated with my Apple account and I still get the same message. I also checked to make sure the OS software was up to date.
What's going on and why is this so difficult to accomplish??!!

Same problem. I enter my password correctly, and I can't get in. but I can get into Apple Support and other login pages with the same (correct) password. Arg!

Why does Google Maps work so horribly on the iPhone??

Does anybody else get extremely frustrated with Google maps? 9 times out of 10 it takes at least 30 seconds to fully load the map around my area. Showing traffic just doesn't function sometimes. It will stop loading when my map is still grey...the list of glitches goes on and on.
I had an HTC Droid before my iPhone, and although my iPhone is infinitely better, Google Maps did work flawlessly on my Droid.
I almost think that it doesn't work well because of the clash with Google and Apple softwares but I really don't know.
Is this happening to anybody else?

Bingo -- same finding as BikerBill7.
For some reason, even though I do not set "country" in any of my Address Book entries on Mac, for some reason when I sync the iPhone Contacts inserts the "United States" into all my domestic contacts' addresses. Even when I delete the address, re-enter in Address Book, and resync, it still adds the country. (Does not qualify as "syncing" in my opinion...)
As a result, anytime I use my Contacts to obtain directions the Maps app stalls until I can interrupt and delete the "United States" from the address location bar and route again.

I am trying to sync my iphone 4. Get error :"itunes cannot sync apps to the iphone because the apps installed on the iphone cannot be determined"

I wanted to sync my iphone 4 (cdma). I have synced it before successfully. I am getting an error "itunes cannot sync apps to the iphone because the apps installed on the iphone cannot be determined" and the apps and items follwoing apps in syncing (photos for example) will not sync. Items prior to apps synced (calendar/contacts). I restarted both my iphone (currently on ios 4.2.8) and my computer, itunes was on 10.6.1, same problem. I installed itunes 10.6.3, same problem. I had been waiting to update ios to 5.1.1 and would like to do that now, but wanted to sync first. Anyone have any ideas? I am stumped! Thank you.

Hello glenysfromwm
On your computer, try the download link below to get the latest version of iTunes to download so you can sync with your computer.
iTunes 11.1.5
http://support.apple.com/kb/dl1614
Regards,
-Norm G.

Do I need to get a different docking system to fit the Iphone 5?

Do I need to get a different docking system for the iphone 5 than what I currently have?

The question is, what do you currently have? If a system for the older 30-pin dock connector, you will need a converter for the 30-pin dock to Lighning connector. See the Apple store for the adapter.
Such as: http://store.apple.com/us/product/MD823ZM/A/lightning-to-30-pin-adapter?fnode=3c

Embedded YouTube videos don't work on Safari on the iPhone.

Sometime after June 15, 2013, embedded YouTube videos stopped working on web pages on Safari on the iPhone (iOS6). They work on Safari on the Mac and they work in the iOS YouTube app. I see the preview frame and the play button, but when clicking the play button, the frame goes black and nothing ever plays. This worked up until 6/15 and the pages haven't changed. Did Apple do something to stop them from working on the iPhone recently?

You may have turned off an option in Flash preferences to not allow sites to store Flash cookies on your machine. Some videos made in Flash and served from third-party (non-YouTube) pages expect to be able to store Flash cookies, so the videos may not work with this Flash option turned off.
Go to [https://www.macromedia.com/support/documentation/en/flashplayer/help/settings_manager03.html Flash Global Storage Settings Panel] which is served from Adobe/Macromedia's site and check the "Allow third-party Flash content..." box, and the box for "Store common Flash components..." where you can then manage sites you have already visited. You'll have to reload the video page after you change this setting.
Also, leave site feedback on those sites where you experienced the problems encouraging them to use HTML5 for serving video content instead of the proprietary Flash format.

Getting AnyConnect to work on demand on the iPhone

Similar Messages

Maybe you are looking for