Logging Anyconnect Client Activity

We have a number of people working remotely using anyconnect with our Cisco ASA 5510. We need a way to log what times people log in and for how long they are logged in. Is there any way of doing this? It has become very critical for us. If I can't get an answer here I can open up a TAC case if necessary.
Thanks!
-Andy

Login and logout of remote access VPN creates a syslog event. The event id varies according to what type of VPN it is. The easiest way to confirm them is to make sure you have informational logging level set and watch your syslog viewer while logging in and out on a test basis.
You can then add those ids to an event list and set it up to be sent to a syslog server or emailed to you.

Similar Messages

Enforce AnyConnect client to do machine authentication when user is logged on

Hi All,
I want to use AnyConnect as a supplicant to our corporate WLAN and also use Machine Authentication feature on ACS 5.3.
Is there a way how to enforce AnyConnect client to do machine authentication when user is logged on? Sometimes can happen, when user just hybernate the computer and do not log off and log on. If they don't do this in some period, then they are not allowed to use WLAN.
Thanks for your help.
Regards
Karel

The problem appears to be if a user hibernate or ACS is reloaded and machine authentication timer expired and user need to logout and wait or reboot the machine. After that it authenticates and then user can login again. Anyconnect 3.1 will allow eap chainging and should be able to address that problem.

SCEP Client Activity Logs Files - Retention Policy?

In SCEP 2012....
1. Where are client activity log files stored?
2. What is the default retention policy?
I remember with FCS, I think the historical data was stored for 14 months (by default). Is that the same for SCEP?
Andrew Marcos

Logs are in c:\program data\Microsoft\Microsoft Antimalware\Support.
Not sure on retention as I am working in non-persistent VDI's that get their logs reset after a log off!
Cheers
Paul | sccmentor.wordpress.com

Endpoint Protection Client Activity Log

Hello
I'd like to know how long SCCM 2012 keep the Endpoint protection client activity logs (logs of scan,detection, quarantine..etc) and if i can change it?
thanx

HI,
Endpoint Protection history data is deleted after 365 days, it can be controlled in the Site Maintenance task "Endpoint Protection is Delete Aged Endpoint Protection Health Status History Data"
There is also a setting for "Delete Aged Threat Data" which is set to 30 days. It depends on which level of details you are after but it sounds like you should increase the "Delete Aged Threat Data"
Regards,
Jörgen
-- My System Center blog ccmexec.com -- Twitter
@ccmexec

AnyConnect error " User not authorized for AnyConnect Client access, contact your administrator"

Hi everyone,
it's probably just me but I have tried real hard to get a simple AnyConnect setup working in a lab environment on my ASA 5505 at home, without luck. When I connect with the AnyConnect client I get the error message "User not authorized for AnyConnect Client access, contact your administrator". I have searched for this error and tried some of the few solutions out there, but to no avail. I also updated the ASA from 8.4.4(1) to 9.1(1) and ASDM from 6.4(9) to 7.1(1) but still the same problem. The setup of the ASA is straight forward, directly connected to the Internet with a 10.0.1.0 / 24 subnet on the inside and an address pool of 10.0.2.0 / 24 to assign to the VPN clients. Please note that due to ISP restrictions, I'm using port 44455 instead of 443. I had AnyConnect working with the SSL portal, but IKEv2 IPsec is giving me a headache. I have stripped down certificate authentication which I had running before just to eliminate this as a potential cause of the issue. When running debugging, I do not get any error messages - the handshake completes successfully and the local authentication works fine as well.
Please find the current config and debugging output below. I appreciate any pointers as to what might be wrong here.
: Saved
ASA Version 9.1(1)
hostname ASA
domain-name ingo.local
enable password ... encrypted
xlate per-session deny tcp any4 any4
xlate per-session deny tcp any4 any6
xlate per-session deny tcp any6 any4
xlate per-session deny tcp any6 any6
xlate per-session deny udp any4 any4 eq domain
xlate per-session deny udp any4 any6 eq domain
xlate per-session deny udp any6 any4 eq domain
xlate per-session deny udp any6 any6 eq domain
passwd ... encrypted
names
name 10.0.1.0 LAN-10-0-1-x
dns-guard
ip local pool VPNPool 10.0.2.1-10.0.2.10 mask 255.255.255.0
interface Ethernet0/0
switchport access vlan 2
interface Ethernet0/1
interface Ethernet0/2
interface Ethernet0/3
interface Ethernet0/4
interface Ethernet0/5
interface Ethernet0/6
interface Ethernet0/7
interface Vlan1
nameif Internal
security-level 100
ip address 10.0.1.254 255.255.255.0
interface Vlan2
nameif External
security-level 0
ip address dhcp setroute
regex BlockFacebook "facebook.com"
banner login This is a monitored system. Unauthorized access is prohibited.
boot system disk0:/asa911-k8.bin
ftp mode passive
clock timezone PST -8
clock summer-time PDT recurring
dns domain-lookup Internal
dns domain-lookup External
dns server-group DefaultDNS
name-server 10.0.1.11
name-server 75.153.176.1
name-server 75.153.176.9
domain-name ingo.local
object network obj_any
subnet 0.0.0.0 0.0.0.0
object network LAN-10-0-1-x
subnet 10.0.1.0 255.255.255.0
object network Company-IP1
host xxx.xxx.xxx.xxx
object network Company-IP2
host xxx.xxx.xxx.xxx
object network HYPER-V-DUAL-IP
range 10.0.1.1 10.0.1.2
object network LAN-10-0-1-X
access-list 100 extended permit tcp any4 object HYPER-V-DUAL-IP eq 3389 inactive
access-list 100 extended permit tcp object Company-IP1 object HYPER-V-DUAL-IP eq 3389
access-list 100 extended permit tcp object Company-IP2 object HYPER-V-DUAL-IP eq 3389
tcp-map Normalizer
check-retransmission
checksum-verification
no pager
logging enable
logging timestamp
logging list Threats message 106023
logging list Threats message 106100
logging list Threats message 106015
logging list Threats message 106021
logging list Threats message 401004
logging buffered errors
logging trap Threats
logging asdm debugging
logging device-id hostname
logging host Internal 10.0.1.11 format emblem
logging ftp-bufferwrap
logging ftp-server 10.0.1.11 / asa *****
logging permit-hostdown
mtu Internal 1500
mtu External 1500
ip verify reverse-path interface Internal
ip verify reverse-path interface External
icmp unreachable rate-limit 1 burst-size 1
icmp deny any echo External
asdm image disk0:/asdm-711.bin
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
object network obj_any
nat (Internal,External) dynamic interface
object network LAN-10-0-1-x
nat (Internal,External) dynamic interface
object network HYPER-V-DUAL-IP
nat (Internal,External) static interface service tcp 3389 3389
access-group 100 in interface External
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
aaa-server radius protocol radius
aaa-server radius (Internal) host 10.0.1.11
key *****
radius-common-pw *****
user-identity default-domain LOCAL
aaa authentication ssh console radius LOCAL
http server enable
http LAN-10-0-1-x 255.255.255.0 Internal
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec ikev2 ipsec-proposal DES
protocol esp encryption des
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal 3DES
protocol esp encryption 3des
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES
protocol esp encryption aes
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES192
protocol esp encryption aes-192
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES256
protocol esp encryption aes-256
protocol esp integrity sha-1 md5
crypto ipsec security-association pmtu-aging infinite
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
crypto map External_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map External_map interface External
crypto ca trustpoint srv01_trustpoint
enrollment terminal
crl configure
crypto ca trustpoint asa_cert_trustpoint
keypair asa_cert_trustpoint
crl configure
crypto ca trustpoint LOCAL-CA-SERVER
keypair LOCAL-CA-SERVER
crl configure
crypto ca trustpool policy
crypto ca server
cdp-url http://.../+CSCOCA+/asa_ca.crl:44435
issuer-name CN=...
database path disk0:/LOCAL_CA_SERVER/
smtp from-address ...
publish-crl External 44436
crypto ca certificate chain srv01_trustpoint
certificate <output omitted>
quit
crypto ca certificate chain asa_cert_trustpoint
certificate <output omitted>
quit
crypto ca certificate chain LOCAL-CA-SERVER
certificate <output omitted>
quit
crypto ikev2 policy 1
encryption aes-256
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 10
encryption aes-192
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 20
encryption aes
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 30
encryption 3des
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 40
encryption des
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 enable External client-services port 44455
crypto ikev2 remote-access trustpoint asa_cert_trustpoint
telnet timeout 5
ssh LAN-10-0-1-x 255.255.255.0 Internal
ssh xxx.xxx.xxx.xxx 255.255.255.255 External
ssh xxx.xxx.xxx.xxx 255.255.255.255 External
ssh timeout 5
ssh version 2
console timeout 0
no vpn-addr-assign aaa
no ipv6-vpn-addr-assign aaa
no ipv6-vpn-addr-assign local
dhcpd dns 75.153.176.9 75.153.176.1
dhcpd domain ingo.local
dhcpd option 3 ip 10.0.1.254
dhcpd address 10.0.1.50-10.0.1.81 Internal
dhcpd enable Internal
threat-detection basic-threat
threat-detection scanning-threat shun except ip-address LAN-10-0-1-x 255.255.255.0
threat-detection statistics access-list
threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
dynamic-filter use-database
dynamic-filter enable interface Internal
dynamic-filter enable interface External
dynamic-filter drop blacklist interface Internal
dynamic-filter drop blacklist interface External
ntp server 128.233.3.101 source External
ntp server 128.233.3.100 source External prefer
ntp server 204.152.184.72 source External
ntp server 192.6.38.127 source External
ssl encryption aes256-sha1 aes128-sha1 3des-sha1
ssl trust-point asa_cert_trustpoint External
webvpn
port 44433
enable External
dtls port 44433
anyconnect image disk0:/anyconnect-win-3.1.02026-k9.pkg 1
anyconnect profiles profile1 disk0:/profile1.xml
anyconnect enable
smart-tunnel list SmartTunnelList1 mstsc mstsc.exe platform windows
smart-tunnel list SmartTunnelList1 putty putty.exe platform windows
group-policy DfltGrpPolicy attributes
vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec ssl-client ssl-clientless
webvpn
anyconnect profiles value profile1 type user
username write.ingo password ... encrypted
username ingo password ... encrypted privilege 15
username tom.tucker password ... encrypted
class-map TCP
match port tcp range 1 65535
class-map type regex match-any BlockFacebook
match regex BlockFacebook
class-map type inspect http match-all BlockDomains
match request header host regex class BlockFacebook
class-map inspection_default
match default-inspection-traffic
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 1500
id-randomization
policy-map TCP
class TCP
set connection conn-max 1000 embryonic-conn-max 1000 per-client-max 250 per-client-embryonic-max 250
set connection timeout dcd
set connection advanced-options Normalizer
set connection decrement-ttl
policy-map type inspect http HTTP
parameters
protocol-violation action drop-connection log
class BlockDomains
policy-map global_policy
class inspection_default
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
inspect dns preset_dns_map dynamic-filter-snoop
inspect http HTTP
service-policy global_policy global
service-policy TCP interface External
smtp-server 199.185.220.249
privilege cmd level 3 mode exec command perfmon
privilege cmd level 3 mode exec command ping
privilege cmd level 3 mode exec command who
privilege cmd level 3 mode exec command logging
privilege cmd level 3 mode exec command failover
privilege cmd level 3 mode exec command vpn-sessiondb
privilege cmd level 3 mode exec command packet-tracer
privilege show level 5 mode exec command import
privilege show level 5 mode exec command running-config
privilege show level 3 mode exec command reload
privilege show level 3 mode exec command mode
privilege show level 3 mode exec command firewall
privilege show level 3 mode exec command asp
privilege show level 3 mode exec command cpu
privilege show level 3 mode exec command interface
privilege show level 3 mode exec command clock
privilege show level 3 mode exec command dns-hosts
privilege show level 3 mode exec command access-list
privilege show level 3 mode exec command logging
privilege show level 3 mode exec command vlan
privilege show level 3 mode exec command ip
privilege show level 3 mode exec command failover
privilege show level 3 mode exec command asdm
privilege show level 3 mode exec command arp
privilege show level 3 mode exec command ipv6
privilege show level 3 mode exec command route
privilege show level 3 mode exec command ospf
privilege show level 3 mode exec command aaa-server
privilege show level 3 mode exec command aaa
privilege show level 3 mode exec command eigrp
privilege show level 3 mode exec command crypto
privilege show level 3 mode exec command ssh
privilege show level 3 mode exec command vpn-sessiondb
privilege show level 3 mode exec command vpnclient
privilege show level 3 mode exec command vpn
privilege show level 3 mode exec command dhcpd
privilege show level 3 mode exec command blocks
privilege show level 3 mode exec command wccp
privilege show level 3 mode exec command dynamic-filter
privilege show level 3 mode exec command webvpn
privilege show level 3 mode exec command service-policy
privilege show level 3 mode exec command module
privilege show level 3 mode exec command uauth
privilege show level 3 mode exec command compression
privilege show level 3 mode configure command interface
privilege show level 3 mode configure command clock
privilege show level 3 mode configure command access-list
privilege show level 3 mode configure command logging
privilege show level 3 mode configure command ip
privilege show level 3 mode configure command failover
privilege show level 5 mode configure command asdm
privilege show level 3 mode configure command arp
privilege show level 3 mode configure command route
privilege show level 3 mode configure command aaa-server
privilege show level 3 mode configure command aaa
privilege show level 3 mode configure command crypto
privilege show level 3 mode configure command ssh
privilege show level 3 mode configure command dhcpd
privilege show level 5 mode configure command privilege
privilege clear level 3 mode exec command dns-hosts
privilege clear level 3 mode exec command logging
privilege clear level 3 mode exec command arp
privilege clear level 3 mode exec command aaa-server
privilege clear level 3 mode exec command crypto
privilege clear level 3 mode exec command dynamic-filter
privilege cmd level 3 mode configure command failover
privilege clear level 3 mode configure command logging
privilege clear level 3 mode configure command arp
privilege clear level 3 mode configure command crypto
privilege clear level 3 mode configure command aaa-server
prompt hostname context
no call-home reporting anonymous
call-home
profile CiscoTAC-1
no active
destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
destination address email [email protected]
destination transport-method http
subscribe-to-alert-group diagnostic
subscribe-to-alert-group environment
subscribe-to-alert-group inventory periodic monthly
subscribe-to-alert-group configuration periodic monthly
subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:41a021a28f73c647a2f550ba932bed1a
: end
Many thanks,
Ingo

Hi Jose,
here is what I got now:
ASA(config)# sh run | begin tunnel-group
tunnel-group DefaultWEBVPNGroup general-attributes
address-pool VPNPool
authorization-required
and DAP debugging still the same:
ASA(config)# DAP_TRACE: DAP_open: CDC45080
DAP_TRACE: Username: tom.tucker, aaa.cisco.grouppolicy = DfltGrpPolicy
DAP_TRACE: Username: tom.tucker, aaa.cisco.username = tom.tucker
DAP_TRACE: Username: tom.tucker, aaa.cisco.username1 = tom.tucker
DAP_TRACE: Username: tom.tucker, aaa.cisco.username2 =
DAP_TRACE: Username: tom.tucker, aaa.cisco.tunnelgroup = DefaultWEBVPNGroup
DAP_TRACE: Username: tom.tucker, DAP_add_SCEP: scep required = [FALSE]
DAP_TRACE: Username: tom.tucker, DAP_add_AC:
endpoint.anyconnect.clientversion="3.1.02026";
endpoint.anyconnect.platform="win";
DAP_TRACE: Username: tom.tucker, dap_aggregate_attr: rec_count = 1
DAP_TRACE: Username: tom.tucker, Selected DAPs: DfltAccessPolicy
DAP_TRACE: Username: tom.tucker, DAP_close: CDC45080
Unfortunately, it still doesn't work. Hmmm.. maybe a wipe of the config and starting from scratch can help?
Thanks,
Ingo

Anyconnect client and clientless connections hang for two users

ASA 5525, v. 9.1(5)19
Anyconnect client 3.1.02026
I have two users who are unable to connect via the AC client or clientless through the web portal. Using the client, it will get stuck in a loop of "checking for updates". On the portal, the connection will proceed to the point of "Cisco Secure Desktop successfully validated... Success.. Reloading..please wait." Then it hangs there.
The issue occurs for the user regardless of which company laptop she logs onto. A help desk tech can use her laptop and successfully connect, but she cannot connect on her own laptop or on another laptop. (Same for the other user.) So the issue doesn't seem to be related to her laptop or the AC installation. (Help desk did reimage her machine early in the troubleshooting process before they realized that the issue seemed to follow the user.)
I've updated the hostscan file - no change in results. Client and clientless connections seem to be working fine for all other users. We're stumped. Suggestions, anyone? thanks!

The LDAP should be server folks -- Active Directory. Chances are whoever manages the ASA's should have access to at least look in Active Directory to look that up. If they don't they need it.
I obviously don't know a lot about what devices you are using, but if you are using ISE, there should be some type of MNT device (Monitoring and Troubleshooting) -- which is collecting the logs and, hopefully, sending them to some type of syslog aggregate collection tool (splunk?).
Otherwise, there should be a device called a CAM (Clean Access Manager) that is collecting logs -- which may also be propagated to a syslog aggregate tool -- although with CAM's, you can pull the reports right out of them in a comma deliminated file (.csv) and go through them that way.
-- The thing that gets me is that it happens to two users no matter what computer they try to connect from, no matter what network they connect from, and other users can authenticate and gain network access on those same devices.
-- That is why it is rather perplexing. Pretty much saying it has to be something with:
- the IP pool they are getting an IP from
- their AD credentials
- their username
- something along those lines, if the information provided was fully accurate.

AnyConnect client reconnects after 1 minute

AnyConnect client reconnects after 1 minute; WHY
version 3.1.02026
ASA:asa911-k8.bin
[25-4-2013 8:16:11] Establishing VPN session...
[25-4-2013 8:16:11] Checking for profile updates...
[25-4-2013 8:16:11] Checking for product updates...
[25-4-2013 8:16:11] Checking for customization updates...
[25-4-2013 8:16:11] Performing any required updates...
[25-4-2013 8:16:12] Establishing VPN session...
[25-4-2013 8:16:12] Establishing VPN - Initiating connection...
[25-4-2013 8:16:12] Establishing VPN - Examining system...
[25-4-2013 8:16:12] Establishing VPN - Activating VPN adapter...
[25-4-2013 8:16:15] Establishing VPN - Configuring system...
[25-4-2013 8:16:16] Establishing VPN...
[25-4-2013 8:16:16] Connected to my.vpn.com.
[25-4-2013 8:16:16] Connected to my.vpn.com.
[25-4-2013 8:17:19] Reconnecting to my.vpn.com...
[25-4-2013 8:17:19] Establishing VPN - Examining system...
[25-4-2013 8:17:24] Establishing VPN - Activating VPN adapter...
[25-4-2013 8:17:25] Establishing VPN - Configuring system...
[25-4-2013 8:17:25] Establishing VPN...
[25-4-2013 8:17:25] Connected to my.vpn.com.
[25-4-2013 8:17:25] Reconnecting to my.vpn.com...
[25-4-2013 8:17:25] Establishing VPN - Examining system...
[25-4-2013 8:17:25] Establishing VPN - Activating VPN adapter...
[25-4-2013 8:17:25] Establishing VPN - Configuring system...
[25-4-2013 8:17:25] Establishing VPN...
[25-4-2013 8:17:25] Connected to my.vpn.com.
[25-4-2013 8:16:11] Establishing VPN session...
[25-4-2013 8:16:11] Checking for profile updates...
[25-4-2013 8:16:11] Checking for product updates...
[25-4-2013 8:16:11] Checking for customization updates...
[25-4-2013 8:16:11] Performing any required updates...
[25-4-2013 8:16:12] Establishing VPN session...
[25-4-2013 8:16:12] Establishing VPN - Initiating connection...
[25-4-2013 8:16:12] Establishing VPN - Examining system...
[25-4-2013 8:16:12] Establishing VPN - Activating VPN adapter...
[25-4-2013 8:16:15] Establishing VPN - Configuring system...
[25-4-2013 8:16:16] Establishing VPN...
[25-4-2013 8:16:16] Connected to my.vpn.com.
[25-4-2013 8:16:16] Connected to my.vpn.com.
[25-4-2013 8:17:19] Reconnecting to my.vpn.com...
[25-4-2013 8:17:19] Establishing VPN - Examining system...
[25-4-2013 8:17:24] Establishing VPN - Activating VPN adapter...
[25-4-2013 8:17:25] Establishing VPN - Configuring system...
[25-4-2013 8:17:25] Establishing VPN...
[25-4-2013 8:17:25] Connected to my.vpn.com.
[25-4-2013 8:17:25] Reconnecting to my.vpn.com...
[25-4-2013 8:17:25] Establishing VPN - Examining system...
[25-4-2013 8:17:25] Establishing VPN - Activating VPN adapter...
[25-4-2013 8:17:25] Establishing VPN - Configuring system...
[25-4-2013 8:17:25] Establishing VPN...
[25-4-2013 8:17:25] Connected to my.vpn.com.

Hello Michael,
The problem here is because we cannot succesfully establish a DTLS tunnel. This could happen because:
- DTLS is blocked somewhere in the path
- A non-default DTLS port is being used
If DTLS is blocked in the middle the issue is because as of ASA Release 9.x and AnyConnect Release 3.x, an optimization has been introduced in the form of distinct Maximum Transition Units (MTUs) that are negotiated for TLS/DTLS between the client/ASA. Previously, the client derived a rough estimate MTU which covered both TLS/DTLS and was obviously less than optimal. Now, the ASA computes the encapsulation overhead for both TLS/DTLS and derives the MTU values accordingly.
As long as DTLS is enabled, the client applies the DTLS MTU (in this case 1418) on the VPN adapter (which is enabled before the DTLS tunnel is established and is needed for routes/filters enforcement), to ensure optimum performance. If the DTLS tunnel cannot be established or it is dropped at some point, the client fails over to TLS and adjusts the MTU on the virtual adapter (VA) to the TLS MTU value (this requires a session level reconnect).
In order to eliminate this visible transition of DTLS > TLS, you can configure a separate tunnel group for TLS only access for users that have trouble with the establishment of the DTLS tunnel (such as due to firewall restrictions).
1. The best option is to set the AnyConnect MTU value to be lower than the TLS MTU, which is then negotiated.
group-policy ac_users_group attributes
webvpn
anyconnect mtu 1300
This makes TLS and DTLS MTU values equal. Reconnections are not seen in this case.
2. The second option is to allow fragmentation.
group-policy ac_users_group attributes
webvpn
anyconnect ssl df-bit-ignore enable
With fragmentation, large packets (whose size exceeds the MTU value) can be fragmented and sent through the TLS tunnel.
3. The third option is to set the Maximum Segment Size (MSS) to 1460 as follows:
sysopt conn tcpmss 1460
In this case, the TLS MTU will be 1427 (RC4/SHA1) which is larger than the DTLS MTU 1418 (AES/SHA1/LZS). This should resolve the issue with TCP from the ASA to the AnyConnect client (thanks to MSS), but large UDP traffic from the ASA to the AnyConnect client might suffer from this as it will be dropped by the AnyConnect client due to the lower AnyConnect client MTU 1418. If sysopt conn tcpmss is modified, it might affect other features such as LAN-to-LAN (L2L) IPSec VPN tunnels.
If DTLS is not blocked in the middle another potential cause for the DTLS failure that DTLS is configured on a non-default port after the WebVPN is enabled (for example, when the webvpn enable outside command is entered). This is due to Cisco bug ID CSCuh61321 and has been seen in Release 9.x where the ASA pushes the non-default port to the client, but continues to listen to the default port. Consequently, the DTLS is not built and AnyConnect reconnects.
The workaround for this problem is:
Disable the WebVPN.
Enter the DTLS port.
Enable the WebVPN.
Regards,
-Gustavo Medina

Pull a report of Anyconnect clients in use

Is there a way to find out who is connecting with which version of the Anyconnect client within the ASA?

Another 'workaround' that you can do to get historical data is set up dap policies. If you are using the HostScan feature, set up separate dap policies for each version of anyconnect you think people might have. If you are externally syslogging the data, you can search through the logs and find unique users with what versions they are using.

SSL Certificate Mismatch with AnyConnect client

Hello,
We are having a problem with the AnyConnect client when connecting to our VPN. We are running the following:
AnyConnect v2.4.0202
(2 each) ASA v8.2(1) -- active/standby failover
AnyConnect Essentials Licensing
NOTE: We are not using certificates for authentication.
Primary clients: Windows XP and Windows 7
Problem
We have purchased an Entrust certificate for our ASA failover cluster called "vpn.company.com" and the it is attached to the outside interface on the ASA.
Steps to Reproduce
Install the AnyConnect (AC) client via https://vpn.company.com/. Connection occurs here without issue.
Once the AC client is installed and we try to use it in stand-alone mode (i.e., w/o hitting the ASA w/ a browser), a certificate mismatch occurs, and AC brings up the Windows/IE Security Alert dialog (see attachment CertError.jpg).
The user must press Yes to bypass mismatch.
PROBLEM: On Windows 7, the user must have administrative privileges and run the AC client as administrator -- otherwise, they get a dialog saying "Unable to establich VPN" (see attachment Unable.jpg).
The issue is we have a valid certificate that should be used for the connection. However, when looking at the connections made by the AC client with Fiddler, it would appear that the AC client is trying to connect directly to the ASA's IP address, and not the name. This is a nuisance for XP users, and a show-stopper for Win7 users as they do not have admin privileges.
I have not been able to find any documentation on Cisco.com relating to this issue. In short, how do I get the AC client to use "vpn.company.com" so there is no Cert mismatch?
Thanks,
-Matt

Tim,
I will read through the article more thoroughly; I've already been through parts of it -- won't hurt to go through again. I did initially have the IP address in my XML file, and immediately removed it when I noticed that it was using the IP address in the FIddler dump. It hasn't had any effect unfortunately -- even with uninstalling and re-installing the AC client locally.
The only other article/post I've come across on Cisco's site that comes close is here:
Cisco Support Community: ASA VPN Load Balancing/Clustering with Digital Certificates Deployment Guide
which seems to suggest that I will need a UCC certificate (which seems ridiculous) to do some of what I need to do. However the issue with that post is that it still wouldn't fix the issue where the AC client is using the IP address.
I will let you know if I find any smoking guns in the doco link you sent. Any other thoughts appreciated. I can't believe Cisco made the setup of the AC client this convoluted.
Thanks!
-Matt

AnyConnect Client v3.1 driver error on windows 7

Hello,
I used AnyConnect Client v3.0 on my windows 7 machine and worked well. But after automatic upgrade to v3.1 by the VPN server(ASA) and it does not work any more. It seems that VPN authentication is successful but activation of VPN adapter fails.
I see two error messages below:
The VPN client driver has encountered an error. Please restart your computer or device, then try again.
AnyConnect was not able to establish a connection to the specified secure gateway. Please try connecting again.
Message History:
[30/08/2013 6:03:14 PM] Ready to connect.
[30/08/2013 6:04:20 PM] Contacting vpn.example.com.
[30/08/2013 6:04:25 PM] User credentials entered.
[30/08/2013 6:04:26 PM] Establishing VPN session...
[30/08/2013 6:04:26 PM] Checking for profile updates...
[30/08/2013 6:04:26 PM] Checking for product updates...
[30/08/2013 6:04:26 PM] Checking for customization updates...
[30/08/2013 6:04:26 PM] Performing any required updates...
[30/08/2013 6:04:32 PM] Establishing VPN session...
[30/08/2013 6:04:32 PM] Establishing VPN - Initiating connection...
[30/08/2013 6:04:33 PM] Establishing VPN - Examining system...
[30/08/2013 6:04:33 PM] Establishing VPN - Activating VPN adapter...
[30/08/2013 6:05:13 PM] Establishing VPN - Repairing VPN adapter...
[30/08/2013 6:06:00 PM] Disconnect in progress, please wait...
[30/08/2013 6:11:53 PM] Connection attempt has failed.
[30/08/2013 6:11:54 PM] Ready to connect.
I already did most of suggestions below from google but still the issue has not been resolved.
- Rebooted the laptop
- Confirm ICS disabled
- Remove Anyconnect client from the laptop and reinstall
- http://www.lehigh.edu/~inlts/comp/docs/vpn/cisco-drvr.html
Cheers
Jeong

I am also facing the exact same issue. I even tried with the newer version. But it does not work. During connection, it asks for accepting the banner and the suddenly the cisco adapter driver gets uninstalled from device manager and cisco pops-up the error screen.
" the VPN client driver encountered an error. Please restart your computer or device and try again"
Please help.

Anyconnect Client Customization?

Greetings,
We are using Anyconnect 2.3.0254 client + SBL/gina and are looking to customize the client even further to prevent user from Disconnecting from the VPN tunnel.
Basically we have remote users that come in on EVDO using Verizon VZaccess Manager. I have that set to start before login and the VPN as well. All of the works great, but once the user is fully logged in, they can then disconnect from either or both. Using VZAccess manager, I can say the vpn has to be connected, but the if vpn profile does not auto launch completely, it fails. So my other thought is just to block disconnecting from the VPN for those users. I have looked all through the XML customization files for anyconnect, but see nothing for either prevent client disconnect, or autolaunch profile entirely. Am I missing something, or is this not possible? Any other suggestions?
Thanks.
bldavis

User profiles are created by an administrator and are automatically delivered to a client machine during connection setup. Profiles provide basic information about connection setup, and users cannot manage or modify them.
An AnyConnect client user profile is an XML file that lets you identify the secure gateway (security appliance) hosts that you want to make accessible. In addition, the profile conveys additional connection attributes and constraints on a user.
Usually, a user has a single profile file. This profile contains all the hosts needed by a user, and additional settings as needed. In some cases, you might want to provide more than one profile for a given user. For example, someone who works from multiple locations might need more than one profile. In such cases, the user selects the appropriate profile from a drop-down list. Be aware, however, that some of the profile settings, such as Start Before Login, control the connection experience at a global level. Other settings, such as those unique to a particular host, depend on the host selected.

AnyConnect Client Profile Backup Server Configuration

I'm trying to understand the use of Backup Server option in AnyConnect Client Profile
Configuration > Remote Access VPN > Network (Client) Access > AnyConnect Client Profile > Edit > Backup Server
(Screenshot attached)
My questions:
1. In what all scenarios do we add servers (ASA devices) in this tab
2. If I have same information in two different locations (Site A and Site B) for AnyConnect user, can I add Site A-ASA and Site B-ASA into Backup Server tab as a failover mechanism for end user.
3. Or is it only used to mention ASA devices configured in failover unit
4. In case of failover unit, does it support stateful failover
I could not find answers to above questions from Google search. So, asking here

I think we need to be careful when we talk about failover. The original post was clearly asking about two different scenarios
1) ASAs at two different sites
2) ASAs configured as a High Availability failover pair (Active/Standby).
The profile does work to provide failover in 1) but does not work to provide failover in 2).
I do not know the authoritative answer to the question about IP phones use of the profile. I believe that the answer ought to be that yes the phone would receive the profile after its first connection and would use the backup server identified in the profile is the primary server was not available. That is a basic functionality of the AnyConnect client and if the phone is using the AnyConnect client then it ought to support that failover.
If someone does have an authoritative answer then please speak up. Several of us would like to know the right answer here.
HTH
Rick

AnyConnect client no assigned address error

I am trying to set up the AnyConnect client (v2.4.0196) and when it tries to connect it fails with a no assigned address error. I look in the logs of the ASA and see a No IPv6 address available for SVC connection. IPv6 is disabled on the ASA.
Does anyone know how to prevent the AnyConnect client from trying to get an IPv6 address?
Thanks in advance...

Note that 2.4 is still beta, 2.3.2016 is the latest supported release today.
Having said that, I rather suspect an ASA issue than a client issue. Can you confirm whether or not an ipv4 address is assigned?
I.e. is there something in the logs like:
Oct 13 2009 09:05:55: %ASA-6-737026: IPAA: Client assigned 192.168.0.1 from local pool
Oct 13 2009 09:05:55: %ASA-6-737006: IPAA: Local pool request succeeded for tunnel-group 'DefaultWEBVPNGroup'
(note these are level 6 messages)

Anyconnect clients with intermittant timeout/high MS

I'm having a problem where some clients are pinging servers on my lan just fine, but every so often it hangs with about 2500-3000ms then continues just fine for another 30-40 pings. If I connect with another machine running the same version of Anyconnect (the latest version) it pings consistenty.
Noticing a lot of strange issues with Anyconnect recently - is there any server side logging that can be enabled to gain more insight on what's going on with specific clients? I had to reboot another ASA earlier today to remedy a problem where some new clients could connect but couldn't ping anything...while others would work like nothing was wrong...connecting/disconnecting like usual.
Thanks in advance

Hi,
I wil be difficult to figure out exactly what is going on without a TAC case but here are a couple of pointers that might help you to see what is going on:
1.) Filtered buffered logs on the ASA itself.
To verify if the traffic is dropped on the ASA or not, you can setup buffered logging:
logging buffer-size
logging buffered debugging
logging on
Then, check the IP address which is assigned to your AnyConnect client which is unable to pass traffic and check the entries related to it in the logs:
show logging | i
2.) Check the statistics of the AnyConnect session on the ASA
This command will show you a couple of counters related to your session and might give you a hint of what is wrong:
show vpn-sessiondb detail svc filter a-ipaddress
You can replace a-ipaddress by p-ipaddress or name if you want to filter on public IP of the client or username.
3.) Logs generated by the AnyConnect client itself
If you launch the event viewer from a Windows host where AnyConnect is installed ("eventvwr" command), you'll see that there is a new log type named "Cisco AnyConnect VPN Client". The client will write in there all the logs related to your connection.
If you are using Linux, the logs will either be stored under /var/log/messages or /var/log/syslog.
For OSX, it would be /var/log/system.log.
If you still don't see where the issue is after those steps. my advise would be to open a TAC case to have the issue investigated.
Regards,
Nicolas

AnyConnect Client (3.1.02040) - Windows 8 won't shut down

I've noticed and issue with Windows 8 and AnyConnect Client version 3.1.02040. I've tried various things to try to resolve this issue but have hit a brick wall. Whenever, I run AnyConnect on my Windows 8 PC and then shut it down for the day, the PC won't turn off. I've ensured my AnyConnect client is disconnected and then quit the application and even killed the VPN service.
Has anyone else seen this issue??? Any resolution???

I also have the same problem. There is a few things that I have noticed...
1. If you disable the Network List Service and the Network Location awareness Services and reboot, this problem does not occure. However, when you disable these services, you are no longer able to manager you network connections.
2. There are many errors that appear in the cisco anyconnect secure mobility client event log
System
Provider
[ Name]
acvpnagent
EventID
2
[ Qualifiers]
9216
Level
2
Task
1
Keywords
0x80000000000000
TimeCreated
[ SystemTime]
2013-02-28T20:36:21.000000000Z
EventRecordID
942
Channel
Cisco AnyConnect Secure Mobility Client
Computer
PC2578.swgao.int
Security
EventData
Function: CThread::invokeRun File: .\Utility\Thread.cpp Line: 435 Invoked Function: IRunnable::Run Return Code: -32112629 (0xFE16000B) Description: BROWSERPROXY_ERROR_NO_PROXY_FILE
Provider
[ Name]
acvpnagent
EventID
2
[ Qualifiers]
9216
Level
2
Task
1
Keywords
0x80000000000000
TimeCreated
[ SystemTime]
2013-02-28T20:36:21.000000000Z
EventRecordID
940
Channel
Cisco AnyConnect Secure Mobility Client
Computer
PC2578.swgao.int
Security
EventData
Function: CVirtualAdapter::IsVAEnabled File: .\WindowsVirtualAdapter.cpp Line: 2685 Invoked Function: CVirtualAdapter::IsVAEnabled Return Code: -33554423 (0xFE000009) Description: GLOBAL_ERROR_UNEXPECTED Unexpected VA status bits, 25174019
System
Provider
[ Name]
acvpnagent
EventID
2
[ Qualifiers]
9216
Level
3
Task
1
Keywords
0x80000000000000
TimeCreated
[ SystemTime]
2013-02-28T20:36:21.000000000Z
EventRecordID
936
Channel
Cisco AnyConnect Secure Mobility Client
Computer
PC2578.swgao.int
Security
EventData
Function: CVAMgr::cleanupAddress File: .\VAMgr.cpp Line: 2449 Invoked Function: CNetshDeleteAddress::Run Return Code: -31064051 (0xFE26000D) Description: NETSHCOMMAND_ERROR_PARSE_FAILED
I'm not sure what anyconnect is doing, but it appear when disconnecting something is prevting it from resetting all of the network settings.

Logging Anyconnect Client Activity

Similar Messages

Maybe you are looking for