Cisco anyconnect connection attempt failed please try again windows 11

Some Windows users are reportedly getting the ‘Connection attempt failed‘ error when running the Cisco AnyConnect application in the hopes of establishing a virtual private network (VPN). This issue is reported to occur with Windows 8.1 and Windows 10.

As it turns out, this particular issue can occur due to several different common scenarios. Here’s a list of potential culprits that might be triggering this error code:

• Missing Hotfix for TLS Protocol Renegotiation – As it turns out, there are a couple of updates with the potential of causing issues with Cisco AnyConnect. Several affected users have managed to fix the issue by installing every pending update in order to resolve the inconsistency with the TLS protocol renegotiation and fallback behavior.
• Incompatibility with Windows 10 – According to a lot of Windows 10 users, you can expect to see this problem occurring due to an incompatibility affecting the SSL/TLS API that inhibits the Cisco AnyConnect tool from communicating with an outside server. In this case, you should be able to resolve the issue by forcing the vpnui.exe file to open in compatibility mode with Windows 8.
• Error caused by Windows Update KB 3034682 – If you find yourself in a scenario where the issue suddenly started to occur after WU installed update KB 3034682, chances are the update contains a problematic security rule that is interfering with Cisco AnyConnect. In this case, you can resolve the issue by uninstalling and hiding the problematic update with a specialized utility.
• Hyper-V Conflict on Windows 10 – It’s a well-known fact that Hyper-V is known to conflict with a lot of VPN facilitators such as Cisco AnyConnect and this scenario is no exception. If you find yourself in this scenario, you should be able to resolve the issue by disabling Hyper-V prior to launching the application.
• Connection Sharing is Enabled – As it turns out, you can also expect to see this error code popping up due to a network sharing functionality that interferes with Cisco AnyConnect. If this scenario is applicable, you should be able to fix the problem by disabling the network connection sharing from the Network Connections tab.
• Internet Explorer is configured to Work Offline – Since Cisco AnyConnect and IE share some common functionality, you can expect to see this error in those situations where IE’s offline mode is enabled by default. In this case, you can fix the issue by making some changes via the Registry Editor.

Now that you know every potential scenario that might be responsible for the apparition of the ‘Connection attempt failed‘ error, here’s a list of verified methods that other users have successfully deployed in order to bypass the error message:

1. Install every Pending Windows Update

As it turns out, one of the most common instances that might trigger this problem is a security update (3023607) that ends up affecting the default behavior regarding the TLS protocol renegotiation and fallback behavior.

According to some affected users, the issue was finally resolved after they run the Microsoft Update utility and installed every security and cumulative update including March cumulative security update for Internet Explorer (MS15-018) and Vulnerability in SChannel could allow security feature bypass: March 10, 2015 (MS15-031).

If you’re not certain that you have every available Windows update installed on your computer, follow the instructions below:

1. Press Windows key + R to open up a Run dialog box. Next, type ”ms-settings:windowsupdate’ and press Enter to open up the Windows Update tab of the Settings app.
2. Inside the Windows update screen, go ahead and click on Check for updates. Next, follow the on-screen prompts to install every Windows update that is currently scheduled to be installed.

   Note: Install every type of update including cumulative and security updates, not just important ones.

3. You should keep in mind that if you have a lot of pending updates, you will be prompted to restart before every update is installed. If this happens, restart your PC as instructed, but make sure to return to this screen at the next startup and finish the installation of the rest of the updates.
4. After every pending update is installed, reboot your computer once again and see if the Cisco AnyConnect error is now fixed.

2. Run Cisco AnyConnect in Compatibility Mode (Windows 10 only)

If installing every pending update didn’t do the trick for you or you’re encountering the issue on Windows 10, chances are you’re dealing with an incompatibility issue. This most commonly occurs due to a Critical Windows 10 Update (3023607) that changes some details in regards to the SSL/TLS API in a way that breaks the Cisco AnyConnect app.

If you face this issue on Windows 10, the easiest way to fix it is to force the main executable (the one you use to launch Cisco AnyConnect) to run in Compatibility Mode with Windows 8.

In case you find yourself in this particular scenario, follow the instructions below to force the vpnui.exe executable to run in compatibility mode with Windows 8:

1. Open File Explorer and navigate to the location where you installed the Cisco AnyCOnnect Mobility Client folder. Unless you installed the utility in a custom location, you’ll find it in:

   C:Program Files (x86)CiscoCisco AnyConnect Secure Mobility Client

2. Once you’re inside the correct location, right-click on vpnui.exe and click on the Properties entry from the context menu that just appeared.
3. Once you’re inside the Properties screen, click on Compatibility, then go to Compatibility mode and check the box where it says ‘Run this program in compatibility mode for:’.
4. After checking the box, it will unlock a list of other versions of Windows, select the list and click on Windows 8.
5. Finally, click on Apply and launch the game to see if the graphics error still occurs.

If you already tried forcing the vpnui.exe executable to run in compatibility mode with Windows 8 and you’re still seeing the same Connection attempt failed error, move down to the next potential fix below.

3. Uninstalling & hide the KB 3034682 update

If the first 2 methods did not work for you or were not applicable, the last resort would be to simply uninstall the problematic update that is causing the update on Windows 10 (3034682).

However, keep in mind that unless you take some steps to hide the problematic update, it will eventually find your way onto your computer and cause the same issue all over again after several system restarts.

But you can prevent this from occurring by using the Microsoft Show or Hide troubleshooter to hide the problematic update after you uninstall the KB 3034682 update.

If you’re looking for specific instructions on how to do this, follow the instructions below:

1. Press Windows key + R to open up a Run dialog box. Next, type “ms-settings:windowsupdate” inside the text box and press Enter to open up the Windows Update screen of the Settings app.
2. Inside the Windows Update screen, click on View Update history from the left-hand section of the screen.
3. Next, from the list of recently installed updates loads up, click on Uninstall updates (at the top of the screen).
4. Scroll down through the list of installed updates and locate the KB3034682 update inside the list of installed updates.
5. After you manage to locate the correct update, right-click on it and choose Uninstall from the context menu. Then, click Yes at the confirmation prompt to start the process.
6. Once the update has been uninstalled, visit the download page of the Microsoft Show or Hide troubleshooter package and download the troubleshooter.
7. Once the download is complete, open the .diagcab file and immediately click on the Advanced button. Next, check the box associated with Apply Repairs Automatically.
8. Hit Next to advance to the next menu and wait for the utility to finish the scan for updates before finally clicking on Hide Updates.
9. Once the operation is complete, check the box associated with the update that you want to hide, then click on Next to advance to hide the selected update from Windows Update.
10. Finally, wait until the procedure is complete, then restart your computer and see if the issue has been resolved once the next startup sequence is complete.

If the same issue is still occurring even after you went through the trouble of uninstalling and hiding the problematic update, move down to the next potential fix below.

4. Disabling Hyper-V (Windows 10)

As it turns out, it turns out that you can also expect to encounter this error due to a conflict between Cisco AnyConnect and the main Hyper-V service that’s enabled by default on Windows 10.

Several affected users that were also encountering this problem have reported that they finally managed to fix the ‘Connection attempt failed’ error by temporarily disabling Hyper-V and all associated services before rebooting the computer and using Cisco AnyConnect.

If you suspect this scenario might be applicable to your current situation, follow the instructions below to disable Hyper-V from the Windows Features menu:

1. Start by pressing Windows key + R to open up a Run dialog box. Inside the text box, type ‘appwiz.cpl’ and press Enter to open up the Programs and Features menu. If you are prompted by the UAC (User Account Control), click Yes to grant admin access.
2. Next, from the Programs and Features menu, use the menu on the left to click on Turn Windows features on or off. At the User Account Control prompt, click Yes to grant admin access.
3. Once you’re inside the Windows Features screen, scroll down through the list of Windows Features and uncheck the box associated with Hyper-V. Next, click on Ok to save the changes.
4. Once the Hyper-V functionality is disabled, restart your computer and see if the problem is fixed once the next startup is complete.

5. Disable Network Connection sharing

If none of the methods above have worked for you, and you are currently sharing a network connection via the Microsoft Hosted Network Virtual Adapter, you might be able to resolve the ‘Connection attempt failed‘ error by disabling the shared network connection.

If this scenario is applicable to your particular scenario, several affected users have managed to fix this issue by accessing the Network Connections tab and modifying the default Sharing configuration so that network connection sharing is not allowed.

If you’re looking for specific step-by-step instructions on how to do this, follow the instructions below:

1. Start by press Windows key + R to open up a Run dialog box. Inside the ‘ncpa.cpl’ inside the text box and press Enter to open up the Network Connections tab. If you’re prompted by the UAC (User Account Control), click Yes to grant admin access.
2. Inside the Network Connections tab, look through the list of network adapters and identify the one created specifically for hosting hotspot networks. Traditionally, it should be named Microsoft Hosted Network Virtual Adapter. 
3. Once you identify the correct network adapter, right-click on it and choose Properties from the context menu that just appeared.

   Note: When you see the UAC (User Account Control), click Yes to grant admin access.

4. Inside the Properties screen of the Microsoft Hosted Network Virtual Adapter, access the Sharing tab from the menu at the top, then uncheck the box associated with Allow other network users to connect through this computer’s Internet connection.
   
5. Finally, click Ok to save the changes, then restart your computer.
6. Attempt to start the hotspot network once again and see if the issue is now resolved.

In case the same kind of problem is still occurring, move down to the next potential fix below.

6. Disable IE’S Ability to Work Offline via Registry Editor

If none of the methods above have proven to be effective in your case, it’s also possible to face this problem to the fact that Internet Explorer is configured to ‘work in offline mode’. IE’s Offline mode is notoriously known to conflict with a lot of VPN facilitators such as the Cisco AnyConnect software.

This would not be a problem if Microsoft didn’t remove the option to change this default behavior and made it so that the option now defaults to online.

Since there’s no longer an option to make this modification from the GUI menu, you’ll have to resort to a Registry modification.

Follow the instructions below to disable Internet Explorer’s ability to work in Offline Mode via Registry Editor:

1. Press Windows key + R to open up a Run dialog box. Next, type ‘regedit’ and press Ctrl + Shift + Enter to open up an elevated Registry Editor prompt. When you are prompted by the UAC (User Account Control), click Yes to grant admin access.
2. Inside the Registry Editor, use the left-hand side menu to navigate to the following location:

   HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionInternet Settings

   Note: You can either navigate to this location manually or you can paste the location directly into the navigation bar and press Enter to get there instantly.

3. Once you get to the correct location, move down to the right-hand side section and locate the GlobalUserOffline DWORD key.
4. When you see it, double-click on it and set the Base to Hexadecimal and the value to 0, and click Ok to save the changes.
5. Restart your computer and see if the problem is fixed once the next startup is complete.

Я пытаюсь подключиться к VPN на своем рабочем месте, но Cisco AnyConnect не работает после запуска соединения. Появляется ошибка с сообщением The VPN client failed to establish a connection , после чего появляется другая ошибка: AnyConnect was not able to establish a connection to the specified secure gateway. Please try connecting again. Я все пробовал. Переустановка, перезапуск и другие другие функции, такие как отключение ICS (общий доступ к подключению Интернета). Я попробовал это на своем ноутбуке, и веб-установщик работал нормально. Он установил клиента и подключился отлично, так что это должно быть что-то с этим ПК. Я пытаюсь понять это примерно в течение 5 часов, и Google не помогает. Вот история сообщений от AnyConnect:

[11/11/2013 1:55:55 PM] Ready to connect. [11/11/2013 1:57:05 PM] Contacting —.—.—.— [11/11/2013 1:57:07 PM] Please enter your username and password. [11/11/2013 1:57:08 PM] User credentials entered. [11/11/2013 1:57:08 PM] Establishing VPN session. [11/11/2013 1:57:09 PM] Checking for profile updates. [11/11/2013 1:57:09 PM] Checking for product updates. [11/11/2013 1:57:10 PM] Checking for customization updates. [11/11/2013 1:57:10 PM] Performing any required updates. [11/11/2013 1:57:15 PM] Establishing VPN session. [11/11/2013 1:57:15 PM] Establishing VPN — Initiating connection. [11/11/2013 1:57:16 PM] Disconnect in progress, please wait. [11/11/2013 1:57:29 PM] Connection attempt has failed. [11/11/2013 1:59:31 PM] Ready to connect.

Я попытался отключить брандмауэр и антивирус. Я не думал, что это будет иметь значение, поскольку мой ноутбук использует тот же брандмауэр и антивирус, и мне не нужно было его отключать. Мой ноутбук использует Windows 7 Home 64-bit, а мой компьютер с ошибкой использует 64-разрядную версию Windows 7 Ultimate.

6 ответов

Решением для меня было отключить общий доступ к подключению Интернета (ICS).

Чтобы устранить эту проблему:

1. Нажмите кнопку Windows Start .
2. Нажмите Control Panel .
3. Установите View by: в Category .
4. Нажмите View network status and tasks в Network and Internet .
5. Нажмите Change adapter settings .
6. Найдите Shared в столбце Status и щелкните его правой кнопкой мыши и нажмите Properties .
7. Перейдите на вкладку Sharing .
8. Снимите флажок Allow other network users to connect through this computer’s Internet connection .
9. Нажмите OK .
10. Переустановите Cisco AnyConnect.

Я вижу, что отключение ICS не работало для OP, но это работало для меня и многих других, по мнению различных форумов, кажется.

Это может быть проблема с ThinkPad. Lenovo опубликовала рекомендательную статью , указывающую, что их программное обеспечение Access Connections мешает AnyConnect. Решение состоит в отключении ICS. У меня нет способа установить, является ли это фактической причиной моей проблемы, но решение работает.

ответ Натана на этой странице не работал для меня, потому что флажки Allow other network users[. ] были очищены для всех все равно.

Я отключил ICS таким образом:

Введите services.msc в меню Windows после нажатия кнопки «Пуск». Щелкните правой кнопкой мыши на services.msc , который появляется после завершения поиска, и Run as Administrator.

Найдите Internet Connection Sharing , остановите его и установите для запуска Manually .

KB ID 0001279В DtdВ 31/01/17

Problem

We had a firewall fail at work this week, as part of the rebuild the latest OS was put on it, version 9.7(1). I thought no more about it until I tried to VPN in and got this;

I used my Windows 10 VM and that connected fine, only my MacBook could not connect, this VPN tunnel is a big deal I need it to get onto client’s networks. I tried my other VPN connections and every one was fine, only the recently rebuilt one didn’t work? Ive seen OSX throw a wobbly with AnyConnect in the past so I did a complete uninstall, В deleted the opt/cisco folder and put on the latest version (4.4.00243 at time of writing) no change.

Connection attempt has failed due to server communication errors. Please retry the connection

A look in the client message history showed me this..

No valid certificates available for authentication.

I checked my certificates, and the certificate on the firewall both they, (and the certificate chain,) were fine.

Debugging AnyConnect gave NO OUTPUT at all, but debugging SSL showed me this;

Try Googling that and getting a result! In fact that’s probably what brought you here.

Solution

If you change a Cisco OS and things like this stop working normally it’s because they’ve dropped support for something that’s got a security hole in it. In the wake of the Poodle Exploit I assumed it was an SSL/TLS problem, but that wasn’t it.

I was in the right ball park though, and a bit of lateral thinking and SSL cipher problems I’ve had with ASDM, made me think, what if it’s SHA that’s been dropped because everyone is dropping SHA1 cause it’s the hashing algorithm of Satan?

Well as soon as I added a SHA1 ciphers back in, everything started working again!

Disclaimer: SHA1 is bad, where practical all cert ciphers should be at least SHA256

» means nesting-related): — Failed at: @displayUserCertifications user_id [in template «custom.author-acclaim-certifications» at line 4, column 9] ——>

• Mark as New
• Bookmark
• Subscribe
• Mute
• Subscribe to RSS Feed
• Permalink
• Print
• Email to a Friend
• Report Inappropriate Content

Hi all, I’m very new in AnyConnect and I’m doing something wrong.

If I navigate to https://myIP I can successfully log into the portal, download and install the AnyConnect Client and also CONNECT to the VPN.

But if I disconnect to the VPN, and try to login again through the try icon, I get a «connection attempt has failed».

So the only way I have to connect again is to navigate another time to the web portal and then, after login again, the VPN connection is successfully done.

Thanks for your help!

» means nesting-related): — Failed at: @displayUserCertifications user_id [in template «custom.author-acclaim-certifications» at line 4, column 9] ——>

• Mark as New
• Bookmark
• Subscribe
• Mute
• Subscribe to RSS Feed
• Permalink
• Print
• Email to a Friend
• Report Inappropriate Content

Glad you worked it out. Please consider marking as answered and rating helpful post so this can be useful to others who may run into the same issues.

If this posts answers your question or is helpful, please consider rating it and/or marking as answered.

» means nesting-related): — Failed at: @displayUserCertifications user_id [in template «custom.author-acclaim-certifications» at line 4, column 9] ——>

• Mark as New
• Bookmark
• Subscribe
• Mute
• Subscribe to RSS Feed
• Permalink
• Print
• Email to a Friend
• Report Inappropriate Content

Are you using a Router or ASA has the VPN gateway? If you are using an ASA, check your DAP policy under Configuration, Network (Client) Access, Dynamic Access Policies. If there are policies there, chose the profile that is mapped to the tunnel you are connecting too and then go to «Access Method». Ensure «Web Portal» isn’t checked. If you want to be able use the portal and the client, you need to change it to one of the «Both» choices. If there is no DAP, we’ll have to dig a little deeper.

If this posts answers your question or is helpful, please consider rating it and/or marking as answered.

» means nesting-related): — Failed at: @displayUserCertifications user_id [in template «custom.author-acclaim-certifications» at line 4, column 9] ——>

• Mark as New
• Bookmark
• Subscribe
• Mute
• Subscribe to RSS Feed
• Permalink
• Print
• Email to a Friend
• Report Inappropriate Content

Hello Christopher, thanks for your answer.

I’m using an ASA, and in DAP I only have the DfltAccess, and I changed the Access Method from Unchanged to Both, but I have the same problem.

Now I have a question (sorry if it is obvious), using the portal, I provide the login/passwd, but using only the client it doesn’t ask me for credentials, it only shows the certificate error (cause it is self-signed), and when I accept it, the connection fails.

» means nesting-related): — Failed at: @displayUserCertifications user_id [in template «custom.author-acclaim-certifications» at line 4, column 9] ——>

• Mark as New
• Bookmark
• Subscribe
• Mute
• Subscribe to RSS Feed
• Permalink
• Print
• Email to a Friend
• Report Inappropriate Content

When you go to login through the AC client, what is in the «Connect To:» box? It may be an issue regarding the AC profile that gets downloaded after successfully logging in and downloading the client via web portal.

**Please remember to rate helpful posts as well as mark the question as ‘answered’ once your issue is resolved. This will help others to find your solution faster.

» means nesting-related): — Failed at: @displayUserCertifications user_id [in template «custom.author-acclaim-certifications» at line 4, column 9] ——>

• Mark as New
• Bookmark
• Subscribe
• Mute
• Subscribe to RSS Feed
• Permalink
• Print
• Email to a Friend
• Report Inappropriate Content

Hi, in the connect To box there is the public IP of the ASA, so I think it might be correct. Then appears an Untrusted VPN Certificate warning, and after clicking «Connect Anyway» it shows the error.

I have the anyconnect-win-3.1.04063-k9.pkg client software, should I try a lower version?

Maybe I’ll try to create the certificate through a Windows Server CA and then import to ASA and to the client, so see if it solves the issue.

» means nesting-related): — Failed at: @displayUserCertifications user_id [in template «custom.author-acclaim-certifications» at line 4, column 9] ——>

• Mark as New
• Bookmark
• Subscribe
• Mute
• Subscribe to RSS Feed
• Permalink
• Print
• Email to a Friend
• Report Inappropriate Content

First try this. Open the AnyConnect Client, go to the Preferrences tab, and make sure the box that says «Block Untrusted Servers» is NOT checked.

If this posts answers your question or is helpful, please consider rating it and/or marking as answered.

» means nesting-related): — Failed at: @displayUserCertifications user_id [in template «custom.author-acclaim-certifications» at line 4, column 9] ——>

• Mark as New
• Bookmark
• Subscribe
• Mute
• Subscribe to RSS Feed
• Permalink
• Print
• Email to a Friend
• Report Inappropriate Content

Hi Christopher, that was the first I have to do in order to be able to connect when I connect to the VPN (through the web) for the first time. So I can confirm it is unchecked.

Thanks for the advice

» means nesting-related): — Failed at: @displayUserCertifications user_id [in template «custom.author-acclaim-certifications» at line 4, column 9] ——>

• Mark as New
• Bookmark
• Subscribe
• Mute
• Subscribe to RSS Feed
• Permalink
• Print
• Email to a Friend
• Report Inappropriate Content

Do you have access to ASDM or a syslog server? It would be best if you could grab the exact error message in the logs when you try to connect.

Also, if you are using ASDM — make sure you have «Enable Cisco AnyConnect VPN Client Access on the intefaces in the table below» checked. Assuming you are using the «outside» interface, check that one and enable DTLS. Then click «Device Certificate» and make sure you have the correct certificate chosen for the SSL connection (probably the ASAs self signed certificate».

Make sure «Bypass interface access lists for inbound VPN sessions» is checked as well.

If this posts answers your question or is helpful, please cons />

Introduction

This document describes a troubleshooting scenario which applies to applications that do not work through the Cisco AnyConnect VPN Client.

Prerequisites

Requirements

There are no specific requirements for this document.

Components Used

The information in this document is based on a Cisco Adaptive Security Appliance (ASA) that runs Version 8.x.

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, make sure that you understand the potential impact of any command.

Troubleshooting Process

This typical troubleshooting scenario applies to applications that do not work through the Cisco AnyConnect VPN Client for end-users with Microsoft Windows-based computers. These sections address and provide solutions to the problems:

• Installation and Virtual Adapter Issues
• Disconnection or Inability to Establish Initial Connection
• Problems with Passing Traffic
• AnyConnect Crash Issues
• Fragmentation / Passing Traffic Issues

Installation and Virtual Adapter Issues

Complete these steps:

1. Obtain the device log file:
   • Windows XP / Windows 2000:

     Windowssetupapi.log

   • Windows Vista:

     Note: Hidden folders must be made visible in order to see these files.

     WindowsInfsetupapi.app.log
     
         WindowsInfsetupapi.dev.log
     

   If you see errors in the setupapi log file, you can turn up verbosity to 0x2000FFFF.

2. Obtain the MSI installer log file:

   If this is an initial web deploy install, this log is located in the per-user temp directory.

   • Windows XP / Windows 2000:

     Documents and Settings<username>Local SettingsTemp
     

   • Windows Vista:

     Users<username>AppDataLocalTemp
     

   If this is an automatic upgrade, this log is in the temp directory of the system:

   WindowsTemp
   

   The filename is in this format: anyconnect-win-x.x.xxxx-k9-install-yyyyyyyyyyyyyy.log. Obtain the most recent file for the version of the client you want to install. The x.xxxx changes based on the version, such as 2.0.0343, and yyyyyyyyyyyyyy is the date and time of the install.

3. Obtain the PC system information file:
   1. From a Command Prompt/DOS box, type this:
      • Windows XP / Windows 2000:

        winmsd /nfo c:msinfo.nfo
        

      • Windows Vista:

        msinfo32 /nfo c:msinfo.nfo
        

      Note: After you type into this prompt, wait. It can take between two to five minutes for the file to complete.

   2. Obtain a systeminfo file dump from a Command Prompt:

      Windows XP and Windows Vista:

      systeminfo c:sysinfo.txt
      

Refer to AnyConnect: Corrupt Driver Database Issue in order to debug the driver issue.

Disconnection or Inability to Establish Initial Connection

If you experience connection problems with the AnyConnect client, such as disconnections or the inability to establish an initial connection, obtain these files:

• The configuration file from the ASA in order to determine if anything in the configuration causes the connection failure:

  From the console of the ASA, type write net x.x.x.x:ASA-Config.txt where x.x.x.x is the IP address of a TFTP server on the network.

  OR

  From the console of the ASA, type show running-config. Let the configuration complete on the screen, then cut-and-paste to a text editor and save.

• The ASA event logs:
  1. In order to enable logging on the ASA for auth, WebVPN, Secure Sockets Layer (SSL), and SSL VPN Client (SVC) events, issue these CLI commands:

     config terminal
     logging enable
     logging timestamp
     logging class auth console debugging
     logging class webvpn console debugging
     logging class ssl console debugging
     logging class svc console debugging

  2. Originate an AnyConnect session and ensure that the failure can be reproduced. Capture the logging output from the console to a text editor and save.
  3. In order to disable logging, issue no logging enable.
• The Cisco AnyConnect VPN Client log from the Windows Event Viewer of the client PC:
  1. Choose Start > Run.
  2. Enter:

     eventvwr.msc /s

  3. Right-click the Cisco AnyConnect VPN Client log, and select Save Log File as AnyConnect.evt.

     Note: Always save it as the .evt file format.

If the user cannot connect with the AnyConnect VPN Client, the issue might be related to an established Remote Desktop Protocol (RDP) session or Fast User Switching enabled on the client PC. The user can see the AnyConnect profile settings mandate a single local user, but multiple local users are currently logged into your computer. A VPN connection will not be established error message error on the client PC. In order to resolve this issue, disconnect any established RDP sessions and disable Fast User Switching. This behavior is controlled by the Windows Logon Enforcement attribute in the client profile, however currently there is no setting that actually allows a user to establish a VPN connection while multiple users are logged on simultaneously on the same machine. Enhancement request CSCsx15061 was filed to address this feature.

Note: Make sure that port 443 is not blocked so the AnyConnect client can connect to the ASA.

When a user cannot connect the AnyConnect VPN Client to the ASA, the issue might be caused by an incompatibility between the AnyConnect client version and the ASA software image version. In this case, the user receives this error message: The installer was not able to start the Cisco VPN client, clientless access is not available.

In order to resolve this issue, upgrade the AnyConnect client version to be compatible with the ASA software image.

When you log in the first time to the AnyConnect, the login script does not run. If you disconnect and log in again, then the login script runs fine. This is the expected behavior.

When you connect the AnyConnect VPN Client to the ASA, you might receive this error: User not authorized for AnyConnect Client access, contact your administrator.

This error is seen when the AnyConnect image is missing from the ASA. Once the image is loaded to the ASA, AnyConnect can connect without any issues to the ASA.

This error can be resolved by disabling Datagram Transport Layer Security (DTLS). Go to Configuration > Remote Access VPN > Network (Client) Access > AnyConnect Connection Profiles and uncheck the Enable DTLS check box. This disables DTLS.

The dartbundle files show this error message when the user gets disconnected: TUNNELPROTOCOLDPDMGR_ERROR_NO_DPD_RESPONSE:The secure gateway failed to respond to Dead Peer Detection packets. This error means that the DTLS channel was torn due to Dead Peer Detection (DPD) failure. This error is resolved if you tweak the DPD keepalives and issue these commands:

webvpn
   svc keepalive 30
   svc dpd-interval client 80
   svc dpd-interval gateway 80

The svc keepalive and svc dpd-interval commands are replaced by the anyconnect keepalive and anyconnect dpd-interval commands respectively in ASA Version 8.4(1) and later as shown here:

webvpn
anyconnect ssl keepalive 15
anyconnect dpd-interval client 5
anyconnect dpd-interval gateway 5

Problems with Passing Traffic

When problems are detected with passing traffic to the private network with an AnyConnect session through the ASA, complete these data-gathering steps:

1. Obtain the output of the show vpn-sessiondb detail svc filter name <username> ASA command from the console. If the output shows Filter Name: XXXXX, then gather the output for show access-list XXXXX. Verify that the access-list XXXXX does not block the intended traffic flow.
2. Export the AnyConnect statistics from AnyConnect VPN Client > Statistics > Details > Export (AnyConnect-ExportedStats.txt).
3. Check the ASA configuration file for nat statements. If Network Address Translation (NAT) is enabled, these must exempt data that returns to the client as a result of NAT. For example, to NAT exempt (nat 0) the IP addresses from the AnyConnect pool, use this on the CLI:

   access-list in_nat0_out extended permit ip any 10.136.246.0 255.255.255.0
   ip local pool IPPool1 10.136.246.1-10.136.246.254 mask 255.252.0.0
   nat (inside) 0 access-list in_nat0_out

4. Determine if the tunneled default gateway needs to be enabled for the setup. The traditional default gateway is the gateway of last resort for non-decrypted traffic.

   Example:

   
   !--- Route outside 0 0 is an incorrect statement.
   
   route outside 0 0 10.145.50.1
   route inside 0 0 10.0.4.2 tunneled

   For example, if the VPN Client needs to access a resource which is not in the routing table of the VPN Gateway, the packet is routed through the standard default gateway. The VPN gateway does not need the complete internal routing table in order to resolve this. The tunneled keyword can be used in this instance.

5. Verify if the AnyConnect traffic is dropped by the inspection policy of the ASA. You could exempt the specific application that is used by AnyConnct client if you implement the Modular Policy Framework of Cisco ASA. For example, you could exempt the skinny protocol with these commands.

   ASA(config)# policy-map global_policy
   ASA(config-pmap)#  class inspection_default
   ASA(config-pmap-c)# no inspect skinny

AnyConnect Crash Issues

Complete these data-gathering steps:

1. Ensure that the Microsoft Utility Dr Watson is enabled. In order to do this, choose Start > Run, and run Drwtsn32.exe. Configure this and click OK:

   Number of Instructions      : 25
   Number of Errors To Save    : 25
   Crash Dump Type             :  Mini
   Dump Symbol Table           : Checked
   Dump All Thread Contexts    : Checked
   Append To Existing Log File : Checked
   Visual Notification         : Checked
   Create Crash Dump File      : Checked

   When the crash occurs, gather the .log and .dmp files from C:Documents and SettingsAll UsersApplication DataMicrosoftDr Watson. If these files appear to be in use, then use ntbackup.exe.

2. Obtain the Cisco AnyConnect VPN Client log from the Windows Event Viewer of the client PC:
   1. Choose Start > Run.
   2. Enter:

      eventvwr.msc /s

   3. Right-click the Cisco AnyConnect VPN Client log, and select Save Log File As AnyConnect.evt.

      Note: Always save it as the .evt file format.

Fragmentation / Passing Traffic Issues

Some applications, such as Microsoft Outlook, do not work. However, the tunnel is able to pass other traffic such as small pings.

This can provide clues as to a fragmentation issue in the network. Consumer routers are particularly poor at packet fragmentation and reassembly.

Try a scaling set of pings in order to determine if it fails at a certain size. For example, ping -l 500, ping -l 1000, ping -l 1500, ping -l 2000.

It is recommended that you configure a special group for users that experience fragmentation, and set the SVC Maximum Transition Unit (MTU) for this group to 1200. This allows you to remediate users who experience this issue, but not impact the broader user base.

Problem

TCP connections hang once connected with AnyConnect.

Solution

In order to verify if your user has a fragmentation issue, adjust the MTU for AnyConnect clients on the ASA.

 ASA(config)#group-policy <name> attributes
                          webvpn
                              svc mtu 1200

Uninstall Automatically

Problem

The AnyConnect VPN Client uninstalls itself once the connection terminates. The client logs show that keep installed is set to disabled.

Solution

AnyConnect uninstalls itself despite that the keep installed option is selected on the Adaptive Security Device Manager (ASDM). In order to resolve this issue, configure the svc keep-installer installed command under group-policy.

Issue Populating the Cluster FQDN

Problem: AnyConnect client is pre-populated with the hostname instead of the cluster Fully Qualified Domain Name (FQDN).

When you have a load-balancing cluster set up for SSL VPN and the client attempts to connect to the cluster, the request is redirected to the node ASA and the client logs in successfully. After some time, when the client tries to connect to the cluster again, the cluster FQDN is not seen in the Connect to entries. Instead, the node ASA entry to which the client has been redirected is seen.

Solution

This occurs because the AnyConnect client retains the host name to which it last connected. This behavior is observed and a bug has been filed. For complete details about the bug, refer to Cisco bug ID CSCsz39019. The suggested workaround is to upgrade the Cisco AnyConnect to Version 2.5.

Backup Server List Configuration

A backup server list is configured in case the main server selected by the user is not reachable. This is defined in the Backup Server pane in the AnyConnect profile. Complete these steps:

1. Download the AnyConnect Profile Editor (registered customers only) . The file name is AnyConnectProfileEditor2_4_1.jar.
2. Create an XML file with the AnyConnect Profile Editor.
   1. Go to the server list tab.
   2. Click Add.
   3. Type the main server on the Hostname field.
   4. Add the backup server below the backup server list on the Host address field. Then, click Add.
3. Once you have the XML file, you need to assign it to the connection you use on the ASA.
   1. In ASDM, choose Configuration > Remote Access VPN > Network (Client) Access > AnyConnect Connection Profiles.
   2. Select your profile and click Edit.
   3. Click Manage from the Default Group Policy section.
   4. Select your group-policy and click Edit.
   5. Select Advanced and then click SSL VPN Client.
   6. Click New. Then, you need to type a name for the Profile and assign the XML file.
4. Connect the client to the session in order to download the XML file.

AnyConnect: Corrupt Driver Database Issue

This entry in the SetupAPI.log file suggests that the catalog system is corrupt:

W239 driver signing class list "C:WINDOWSINFcertclas.inf" was missing or invalid. Error 0xfffffde5: Unknown Error., assuming all device classes are subject to driver signing policy.

You can also receive this error message: Error(3/17): Unable to start VA, setup shared queue, or VA gave up shared queue.

You can receive this log on the client: "The VPN client driver has encountered an error".

Repair

This issue is due to Cisco bug ID CSCsm54689. In order to resolve this issue, make sure that Routing and Remote Access Service is disabled before you start AnyConnect. If this does not resolve the issue, complete these steps:

1. Open a command prompt as an Administrator on the PC (elevated prompt on Vista).
2. Run net stop CryptSvc.
3. Run:

   esentutl /p%systemroot%System32catroot2
   {F750E6C3-38EE-11D1-85E5-00C04FC295EE}catdb

4. When prompted, choose OK in order to attempt the repair.
5. Exit the command prompt.
6. Reboot.

Failed Repair

If the repair fails, complete these steps:

1. Open a command prompt as an Administrator on the PC (elevated prompt on Vista).
2. Run net stop CryptSvc.
3. Rename the %WINDIR%system32catroot2 to catroot2_old directory.
4. Exit the command prompt.
5. Reboot.

Analyze the Database

You can analyze the database at any time in order to determine if it is valid.

1. Open a command prompt as an Admimistrator on the PC.
2. Run:

   esentutl /g%systemroot%System32catroot2
   {F750E6C3-38EE-11D1-85E5-00C04FC295EE}catdb

   Refer to System Catalog Database Integrity for more information.

Error Messages

Error: Unable to Update the Session Management Database

While the SSL VPN is connected through a web browser, the Unable to Update the Session Management Database. error message appears, and the ASA logs show %ASA-3-211001: Memory allocation Error. The adaptive security appliance failed to allocate RAM system memory.

Solution 1

This issue is due to Cisco bug ID CSCsm51093. In order to resolve this issue, reload the ASA or upgrade the ASA software to the interim release mentioned in the bug. Refer to Cisco bug ID CSCsm51093 for more information.

Solution 2

This issue can also be resolved if you disable threat-detection on ASA if threat-detection is used.

Error: «Module c:Program FilesCiscoCisco AnyConnect VPN Clientvpnapi.dll failed to register»

When you use the AnyConnect client on laptops or PCs, an error occurs during the install:

"Module C:Program FilesCiscoCisco AnyConnect VPN Clientvpnapi.dll failed
to register..."

When this error is encountered, the installer cannot move forward and the client is removed.

Solution

These are the possible workarounds to resolve this error:

• The latest AnyConnect client is no longer officially supported with Microsoft Windows 2000. It is a registry problem with the 2000 computer. 
• Remove the VMware applications. Once AnyConnect is installed, VMware applications can be added back to the PC.
• Add the ASA to their trusted sites. 
• Copy these files from the ProgramFilesCiscoCiscoAnyconnect folder to a new folder and run the regsvr32 vpnapi.dll command prompt:
  • vpnapi.dll
  • vpncommon.dll
  • vpncommoncrypt.dll
• Reimage the operating system on the laptop/PC.

The log message related to this error on the AnyConnect client looks similar to this:

DEBUG: Error 2911:  Could not remove the folderC:Program FilesCiscoCisco AnyConnect
VPN Client.
The installer has encountered an unexpected error installing this package. This may
indicate a problem with this package. The error code is 2911. The arguments are:
C:Program FilesCiscoCisco AnyConnect VPN Client, ,
DEBUG: Error 2911:  Could not remove the folder C:Program FilesCiscoCisco AnyConnect
VPN Client.
The installer has encountered an unexpected error installing this package. This may
indicate a problem with this package. The error code is 2911. The arguments are:
C:Program FilesCiscoCisco AnyConnect VPN Client, ,
Info 1721. There is a problem with this Windows Installer package. A program required for
this install to complete could not be run. Contact your support personnel or package
vendor. Action: InstallHelper.exe, location: C:Program FilesCiscoCisco AnyConnect VPN
ClientInstallHelper.exe, command: -acl "C:Documents and SettingsAll UsersApplication
DataCiscoCisco AnyConnect VPN Client\" -r

Error: «An error was received from the secure gateway in response to the VPN negotiation request. Please contact your network administrator»

When clients try to connect to the VPN with the Cisco AnyConnect VPN Client, this error is received.

This message was received from the secure gateway:

«Illegal address class» or «Host or network is 0» or «Other error»

Solution

The issue occurs because of the ASA local IP pool depletion. As the VPN pool resource is exhausted, the IP pool range must be enlarged.

Cisco bug ID is CSCsl82188 is filed for this issue. This error usually occurs when the local pool for address assignment is exhausted, or if a 32-bit subnet mask is used for the address pool. The workaround is to expand the address pool and use a 24-bit subnet mask for the pool.

Error: Session could not be established. Session limit of 2 reached.

When you try to connect more than two clients with the AnyConnect VPN Client, you receive the Login Failed error message on the Client and a warning message in the ASA logs that states Session could not be established. Session limit of 2 reached. I have the AnyConnect essential license on the ASA, which runs Version 8.0.4.

Solution 1

This error occurs because the AnyConnect essential license is not supported by ASA version 8.0.4. You need to upgrade the ASA to version 8.2.2. This resolves the error.

Note: Regardless of the license used, if the session limit is reached, the user will receive the login failed error message.

Solution 2

This error can also occur if the vpn-sessiondb max-anyconnect-premium-or-essentials-limit session-limit command is used to set the limit of VPN sessions permitted to be established. If the session-limit is set as two, then the user cannot establish more than two sessions even though the license installed supports more sessions. Set the session-limit to the number of VPN sessions required in order to avoid this error message.

Error: Anyconnect not enabled on VPN server while trying to connect anyconnect to ASA

You receive the Anyconnect not enabled on VPN server error message when you try to connect AnyConnect to the ASA.

Solution

This error is resolved if you enable AnyConnect on the outside interface of the ASA with ASDM. For more information on how to enable AnyConnect on the outside interface, refer to Configure Clientless SSL VPN (WebVPN) on the ASA.

Error:- %ASA-6-722036: Group client-group User xxxx IP x.x.x.x Transmitting large packet 1220 (threshold 1206)

The %ASA-6-722036: Group < client-group > User < xxxx > IP < x.x.x.x> Transmitting large packet 1220 (threshold 1206) error message appears in the logs of the ASA. What does this log mean and how is this resolved?

Solution

This log message states that a large packet was sent to the client. The source of the packet is not aware of the MTU of the client. This can also be due to compression of non-compressible data. The workaround is to turn off the SVC compression with the svc compression none command. This resolves the issue.

Error: The secure gateway has rejected the agent’s vpn connect or reconnect request.

When you connect to the AnyConnect Client, this error is received: "The secure gateway has rejected the agent's vpn connect or reconnect request. A new connection requires re-authentication and must be started manually. Please contact your network administrator if this problem persists. The following message was received from the secure gateway: no assigned address".

This error is also received when you connect to the AnyConnect Client: "The secure gateway has rejected the connection attempt. A new connection attempt to the same or another secure gateway is needed, which requires re-authentication. The following message was received from the secure gateway:Host or network is 0".

This error is also received when you connect to the AnyConnect Client: "The secure gateway has rejected the agent's vpn connect or reconnect request. A new connection requires a re-authentication and must be started manually. Please contact the network administrator if the problem persists. The following message was received from the secure gateway: No License".

Solution

The router was missing pool configuration after reload. You need to add the concerned configuration back to the router.

Router#show run | in pool

ip local pool SSLPOOL 192.168.30.2 192.168.30.254
   svc address-pool SSLPOO

The "The secure gateway has rejected the agent's vpn connect or reconnect request. A new connection requires a re-authentication and must be started manually. Please contact the network administrator if the problem persists. The following message was received from the secure gateway: No License" error occurs when the AnyConnect mobility license is missing. Once the license is installed, the issue is resolved.

Error: «Unable to update the session management database»

When you try to authenticate in WebPortal, this error message is received: "Unable to update the session management database".

Solution

This problem is related to memory allocation on the ASA. This issue is mostly encountered when the ASA Version is 8.2.1. Originally, this requires a 512MB RAM for its complete functionality.

As a permanent workaround, upgrade the memory to 512MB.

As a temporary workaround, try to free the memory with these steps:

1. Disable the threat-detection.
2. Disable SVC compression.
3. Reload the ASA.

Error: «The VPN client driver has encountered an error»

This is an error message obtained on the client machine when you try to connect to AnyConnect.

Solution

In order to resolve this error, complete this procedure in order to manually set the AnyConnect VPN agent to Interactive:

1. Right-click My Computer > Manage > Services and Applications > Services > and select the Cisco AnyConnect VPN Agent.
2. Right-click Properties, then log on, and select Allow service to interact with the desktop.

   This sets the registry Type value DWORD to 110 (default is 010) for the HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesvpnagent.

   Note: If this is to be used, then the preference would be to use the .MST transform in this instance. This is because if you set this manually with these methods, it requires that this be set after every install/upgrade process. This is why there is a need to identify the application that causes this problem.

   When Routing and Remote Access Service (RRAS) is enabled on the Windows PC, AnyConnect fails with the The VPN client driver has encountered an error. error message. In order to resolve this issue, make sure that Routing and RRAS is disabled before starting AnyConnect. Refer to Cisco bug ID CSCsm54689 for more information.

Error: «Unable to process response from xxx.xxx.xxx.xxx»

AnyConnect clients fail to connect to a Cisco ASA. The error in the AnyConnect window is "Unable to process response from xxx.xxx.xxx.xxx".

Solution

In order to resolve this error, try these workarounds:

• Remove WebVPN from the ASA and reenable it.<
• Change the port number to 444 from the existing 443 and reenable it on 443.

For more information on how to enable WebVPN and change the port for WebVPN, refer to this Solution.

Error: «Login Denied , unauthorized connection mechanism , contact your administrator»

AnyConnect clients fail to connect to a Cisco ASA. The error in the AnyConnect window is "Login Denied , unauthorized connection mechanism , contact your administrator".

Solution

This error message occurs mostly because of configuration issues that are improper or an incomplete configuration. Check the configuration and make sure it is as required to resolve the issue.

<

Error: «Anyconnect package unavailable or corrupted. Contact your system administrator»

This error occurs when you try to launch the AnyConnect software from a Macintosh client in order to connect to an ASA.

Solution

In order to resolve this, complete these steps:

1. Upload the Macintosh AnyConnect package to the flash of the ASA.
2. Modify the WebVPN configuration in order to specify the AnyConnect package that is used.

   webvpn
    svc image disk0:/anyconnect-macosx-i386-2.3.2016-k9.pkg 2
    svc image disk0:/anyconnect-macosx-powerpc-2.3.2016-k9.pkg 3

   The svc image command is replaced by the anyconnect image command in ASA Version 8.4(1) and later as shown here:

   hostname(config)#webvpn
   hostname(config-webvpn)#anyconnect image disk0:/
   anyconnect-win-3.0.0527-k9.pkg 1
   hostname(config-webvpn)#anyconnect image disk0:/
   anyconnect-macosx-i386-3.0.0414-k9.pkg 2

Error: «The AnyConnect package on the secure gateway could not be located»

This error is caused on the user’s Linux machine when it tries to connect to the ASA by launching AnyConnect. Here is the complete error:

"The AnyConnect package on the secure gateway could not be located. You may
be experiencing network connectivity issues. Please try connecting again."

Solution

In order to resolve this error message, verify whether the Operating System (OS) that is used on the client machine is supported by the AnyConnect client. 

If the OS is supported, then verify if the AnyConnect package is specified in the WebVPN configuration or not. See the Anyconnect package unavailable or corrupted section of this document for more information.

Error: «Secure VPN via remote desktop is not supported»

Users are unable to perform a remote desktop access. The Secure VPN via remote desktop is not supported error message appears.

Solution

This issue is due to these Cisco bug IDs: CSCsu22088 and CSCso42825. If you upgrade the AnyConnect VPN Client, it can resolve the issue. Refer to these bugs for more information.

Error: «The server certificate received or its chain does not comply with FIPS. A VPN connection will not be established»

When you attempt to VPN to the ASA 5505, the The server certificate received or its chain does not comply with FIPS. A VPN connection will not be established error message appears.

Solution

In order to resolve this error, you must disable the Federal Information Processing Standards (FIPS) in the AnyConnect Local Policy file. This file can usually be found at C:ProgramDataCiscoCisco AnyConnect VPN ClientAnyConnectLocalPolicy.xml. If this file is not found in this path, then locate the file at a different directory with a path such as C:Documents and SettingsAll UsersApplication DataCisco AnyConnectVPNClientAnyConnectLocalPolicy.xml. Once you locate the xml file, make changes to this file as shown here:

Change the phrase:

<FipsMode>true</FipsMode>

To:

<FipsMode>false</FipsMode>

Then, restart the computer. Users must have administrative permissions in order to modify this file.

Error: «Certificate Validation Failure»

Users are unable to launch AnyConnect and receive the Certificate Validation Failure error.

Solution

Certificate authentication works differently with AnyConnect compared to the IPSec client. In order for certificate authentication to work, you must import the client certificate to your browser and change the connection profile in order to use certificate authentication. You also need to enable this command on your ASA in order to allow SSL client-certificates to be used on the outside interface:

ssl certificate-authentication interface outside port 443

Error: «VPN Agent Service has encountered a problem and needs to close. We are sorry for the inconvenience»

When AnyConnect Version 2.4.0202 is installed on a Windows XP PC, it stops at updating localization files and an error message shows that the vpnagent.exe fails.

Solution

This behavior is logged in Cisco bug ID CSCsq49102. The suggested workaround is to disable the Citrix client.

Error: «This installation package could not be opened. Verify that the package exists»

When AnyConnect is downloaded, this error message is received:

"Contact your system administrator. The installer failed with the following error: This installation package could not be opened. Verify that the package exists and that you can access it, or contact the application vendor to verify that this is a valid Windows Installer package."

Solution

Complete these steps in order to fix this issue:

1. Remove any anti-virus software.
2. Disable the Windows firewall.
3. If neither Step 1 or 2 helps, then format the machine and then install.
4. If the problem still persists, open a TAC Case.

Error: «Error applying transforms. Verify that the specified transform paths are valid.»

This error message is recieved during the auto-download of AnyConnect from the ASA:

"Contact your system administrator. The installer failed with the following error:
Error applying transforms. Verify that the specified transform paths are valid."

This is the error message received when connecting with AnyConnect for MacOS:

"The AnyConnect package on the secure gateway could not be located. You may be
experiencing network connectivity issues. Please try connecting again."

Solution

Complete one of these workarounds in order to resolve this issue:

1. The root cause of this error might be due to a corrupted MST translation file (for example, imported). Perform these steps to fix this:
   1. Remove the MST translation table.
   2. Configure the AnyConnect image for MacOS in the ASA.
2. From the ASDM, follow the Network (Client) Access > AnyConnect Custom > Installs path and delete the AnyConnect package file. Make sure the package remains in Network (Client) Access > Advanced > SSL VPN > Client Setting.

If neither of these workarounds resolve the issue, contact Cisco Technical Support.

Error: «The VPN client driver has encountered an error»

This error is received:

The VPN client driver has encountered an error when connecting through Cisco
AnyConnect Client.

Solution

This issue can be resolved when you uninstall the AnyConnect Client, and then remove the anti-virus software. After this, reinstall the AnyConnect Client. If this resolution does not work, then reformat the PC in order to fix this issue.

Error: «A VPN reconnect resulted in different configuration setting. The VPN network setting is being re-initialized. Applications utilizing the private network may need to be restored.»

This error is received when you try to launch AnyConnect:

"A VPN reconnect resulted in different configuration setting. The VPN network
setting is being re-initialized. Applications utilizing the private network may
need to be restarted."

Solution

In order to resolve this error, use this:

group-policy <Name> attributes
			webvpn
				svc mtu 1200

The svc mtu command is replaced by the anyconnect mtu command in ASA Version 8.4(1) and later as shown here:

hostname(config)#group-policy <Name> attributes

hostname(config-group-policy)#webvpn
hostname(config-group-webvpn)#anyconnect mtu 500

AnyConnect Error While Logging In

Problem

The AnyConnect receives this error when it connects to the Client:

The VPN connection is not allowed via a local proxy. This can be changed
through AnyConnect profile settings.

Solution

The issue can be resolved if you make these changes to the AnyConnect profile:

Add this line to the AnyConnect profile:

<ProxySettings>IgnoreProxy</ProxySettings><
AllowLocalProxyConnections>
false</AllowLocalProxyConnections>

IE Proxy Setting is Not Restored after AnyConnect Disconnect on Windows 7

Problem

In Windows 7, if the IE proxy setting is configured for Automatically detect settings and AnyConnect pushes down a new proxy setting, the IE proxy setting is not restored back to Automatically detect settings after the user ends the AnyConnect session. This causes LAN issues for users who need their proxy setting configured for Automatically detect settings.

Solution

This behavior is logged in Cisco bug ID CSCtj51376. The suggested workaround is to upgrade to AnyConnect 3.0.

Error: AnyConnect Essentials can not be enabled until all these sessions are closed.

This error message is received on Cisco ASDM when you attempt to enable the AnyConnect Essentials license:

There are currently 2 clientless SSL VPN sessions in progress. AnyConnect
Essentials can not be enabled until all these sessions are closed.

Solution

This is the normal behavior of the ASA. AnyConnect Essentials is a separately licensed SSL VPN client. It is entirely configured on the ASA and provides the full AnyConnect capability, with these exceptions:

• No Cisco Secure Desktop (CSD) (including HostScan/Vault/Cache Cleaner)
• No clientless SSL VPN
• Optional Windows Mobile Support

This license cannot be used at the same time as the shared SSL VPN premium license. When you need to use one license, you need to disable the other.

Error: Connection tab on Internet option of Internet Explorer hides after getting connected to the AnyConnect client.

The connection tab on the Internet option of Internet Explorer hides after you are connected to the AnyConnect client.

Solution

This is due to the msie-proxy lockdown feature. If you enable this feature, it hides the Connections tab in Microsoft Internet Explorer for the duration of an AnyConnect VPN session. If you disable the feature, it leaves the display of the Connections tab unchanged.

Error: Few users getting Login Failed Error message when others are able to connect successfully through AnyConnect VPN

A few users receive the Login Failed Error message when others can connect successfully through the AnyConnect VPN.

Solution

This issue can be resolved if you make sure the do not require pre-authentication checkbox is checked for the users.

Error: The certificate you are viewing does not match with the name of the site you are trying to view.

During the AnyConnect profile update, an error is shown that says the certificate is invalid. This occurs with Windows only and at the profile update phase. The error message is shown here:

The certificate you are viewing does not match with the name of the site
you are trying to view.

Solution

This can be resolved if you modify the server list of the AnyConnect profile in order to use the FQDN of the certificate.

This is a sample of the XML profile:

<ServerList>
 <HostEntry>
    <HostName>vpn1.ccsd.net</HostName>
 </HostEntry>
</ServerList>

Note: If there is an existing entry for the Public IP address of the server such as <HostAddress>, then remove it and retain only the FQDN of the server (for example, <HostName> but not <Host Address>).

Cannot Launch AnyConnect From the CSD Vault From a Windows 7 Machine

When the AnyConnect is launched from the CSD vault, it does not work. This is attempted on Windows 7 machines.

Solution

Currently, this is not possible because it is not supported.

AnyConnect Profile Does Not Get Replicated to the Standby After Failover

The AnyConnect 3.0 VPN client with ASA Version 8.4.1 software works fine. However, after failover, there is no replication for the AnyConnect profile related configuration.

Solution

This problem has been observed and logged under Cisco bug ID CSCtn71662. The temporary workaround is to manually copy the files to the standby unit.

AnyConnect Client Crashes if Internet Explorer Goes Offline

When this occurs, the AnyConnect event log contains entries similar to these:

Description : Function:
CAdapterNetworkStateIfc::SetConnectedStateToConnected
File: .AdapterNetworkStateIfc.cpp
Line: 147
Invoked Function: InternetSetOption
Return Code: 12010 (0x00002EEA)
Description: The length is incorrect for the option type
Description : Function: CTransportWinHttp::InitTransport
File: .CTransportWinHttp.cpp
Line: 252
Invoked Function: CConnectedStateIfc::SetConnectedStateToConnected
Return Code: -25362420 (0xFE7D000C)
Description: CADAPTERNETWORKSTATEIFC_ERROR_SET_OPTION

Solution

This behavior is observed and logged under Cisco bug ID CSCtx28970. In order to resolve this, quit the AnyConnect application and relaunch. The connection entries reappear after relaunch.

Error Message: TLSPROTOCOL_ERROR_INSUFFICIENT_BUFFER

The AnyConnect client fails to connect and the Unable to establish a connection error message is received. In the AnyConnect event log, the TLSPROTOCOL_ERROR_INSUFFICIENT_BUFFER error is found.

Solution

This occurs when the headend is configured for split-tunneling with a very large split-tunnel list (approximately 180-200 entries) and one or more other client attributes are configured in the group-policy, such as dns-server.

In order to resolve this issue, complete these steps:

1. Reduce the number of entries in the split-tunnel list.
2. Use this configuration in order to disable DTLS:

   group-policy groupName attributes
     webvpn
       svc dtls none

For more information, refer to Cisco bug ID CSCtc41770.

Error Message: «Connection attempt has failed due to invalid host entry»

The Connection attempt has failed due to invalid host entry error message is received while AnyConnect is authenticated with the use of a certificate.

Solution

In order to resolve this issue, try either of these possible solutions:

• Upgrade the AnyConnect to Version 3.0.
• Disable Cisco Secure Desktop on your computer.

For more information, refer to Cisco bug ID CSCti73316.

Error: «Ensure your server certificates can pass strict mode if you configure always-on VPN»

When you enable the Always-On feature on AnyConnect, the Ensure your server certificates can pass strict mode if you configure always-on VPN error message is received.

Solution

This error message implies that if you want to use the Always-On feature, you need a valid sever certificate configured on the headend. Without a valid server certificate, this feature does not work. Strict Cert Mode is an option that you set in the AnyConnect local policy file in order to ensure the connections use a valid certificate. If you enable this option in the policy file and connect with a bogus certificate, the connection fails.

Error: «An internal error occurred in the Microsoft Windows HTTP Services»

This Diagnostic AnyConnect Reporting Tool (DART) shows one failed attempt:

******************************************
Date        : 03/25/2014
Time        : 09:52:21
Type        : Error
Source      : acvpnui
Description : Function: CTransportWinHttp::SendRequest
File: .CTransportWinHttp.cpp
Line: 1170
Invoked Function: HttpSendRequest
Return Code: 12004 (0x00002EE4)
Description: An internal error occurred in the Microsoft 
Windows HTTP Services 
*****************************************
Date        : 03/25/2014
Time        : 09:52:21
Type        : Error
Source      : acvpnui
Description : Function: ConnectIfc::connect
File: .ConnectIfc.cpp
Line: 472
Invoked Function: ConnectIfc::sendRequest
Return Code: -30015443 (0xFE36002D)
Description: CTRANSPORT_ERROR_CONN_UNKNOWN
******************************************
Date        : 03/25/2014
Time        : 09:52:21
Type        : Error
Source      : acvpnui
Description : Function: ConnectIfc::TranslateStatusCode
File: .ConnectIfc.cpp
Line: 2999
Invoked Function: ConnectIfc::TranslateStatusCode
Return Code: -30015443 (0xFE36002D)
Description: CTRANSPORT_ERROR_CONN_UNKNOWN
Connection attempt failed.  Please try again.
******************************************

Also, refer to the event viewer logs on the Windows machine.

Solution

This could be caused due to a corrupted Winsock connection. Reset the connection from the command promt with this command and restart your windows machine:

netsh winsock reset

Refer to the How to determine and to recover from Winsock2 corruption in Windows Server 2003, in Windows XP, and in Windows Vista knowledge base article for more information.

Error: «The SSL transport received a Secure Channel Failure.  May be a result of a unsupported crypto configuration on the Secure Gateway.»

This Diagnostic AnyConnect Reporting Tool (DART) shows one failed attempt:

******************************************
Date        : 10/27/2014
Time        : 16:29:09
Type        : Error
Source      : acvpnui
Description : Function: CTransportWinHttp::handleRequestError
File: .CTransportWinHttp.cpp
Line: 854
The SSL transport received a Secure Channel Failure.  May be a result of a unsupported crypto configuration on the Secure Gateway.
******************************************
Date        : 10/27/2014
Time        : 16:29:09
Type        : Error
Source      : acvpnui
Description : Function: CTransportWinHttp::SendRequest
File: .CTransportWinHttp.cpp
Line: 1199
Invoked Function: CTransportWinHttp::handleRequestError
Return Code: -30015418 (0xFE360046)
Description: CTRANSPORT_ERROR_SECURE_CHANNEL_FAILURE
******************************************
Date        : 10/27/2014
Time        : 16:29:09
Type        : Error
Source      : acvpnui
Description : Function: ConnectIfc::TranslateStatusCode
File: .ConnectIfc.cpp
Line: 3026
Invoked Function: ConnectIfc::TranslateStatusCode
Return Code: -30015418 (0xFE360046)
Description: CTRANSPORT_ERROR_SECURE_CHANNEL_FAILURE
Connection attempt failed.  Please try again.
******************************************

Solution

Windows 8.1 does not support RC4 according to the following KB update:

http://support2.microsoft.com/kb/2868725

Either configure DES/3DES ciphers for SSL VPN on the ASA using the command «ssl encryption 3des-sha1 aes128-sha1 aes256-sha1 des-sha1» OR edit the Windows Registry file on the client machine as mentioned below:

https://technet.microsoft.com/en-us/library/dn303404.aspx

Related Information

• Cisco ASA 5500 Series Adaptive Security Appliances
• AnyConnect VPN Client FAQ
• Cisco Secure Desktop (CSD) FAQ
• Cisco AnyConnect VPN Client
• Technical Support & Documentation — Cisco Systems

На чтение 10 мин. Опубликовано 15.12.2019

Introduction

This document describes a troubleshooting scenario which applies to applications that do not work through the Cisco AnyConnect VPN Client.

Prerequisites

Requirements

There are no specific requirements for this document.

Components Used

The information in this document is based on a Cisco Adaptive Security Appliance (ASA) that runs Version 8.x.

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, make sure that you understand the potential impact of any command.

Troubleshooting Process

This typical troubleshooting scenario applies to applications that do not work through the Cisco AnyConnect VPN Client for end-users with Microsoft Windows-based computers. These sections address and provide solutions to the problems:

• Installation and Virtual Adapter Issues
• Disconnection or Inability to Establish Initial Connection
• Problems with Passing Traffic
• AnyConnect Crash Issues
• Fragmentation / Passing Traffic Issues

Installation and Virtual Adapter Issues

Complete these steps:

1. Obtain the device log file:
   • Windows XP / Windows 2000:

     Windowssetupapi.log

   • Windows Vista:

     Note: Hidden folders must be made visible in order to see these files.

     WindowsInfsetupapi.app.log
     
         WindowsInfsetupapi.dev.log
     

   If you see errors in the setupapi log file, you can turn up verbosity to 0x2000FFFF.

2. Obtain the MSI installer log file:

   If this is an initial web deploy install, this log is located in the per-user temp directory.

   • Windows XP / Windows 2000:

     Documents and Settings<username>Local SettingsTemp
     

   • Windows Vista:

     Users<username>AppDataLocalTemp
     

   If this is an automatic upgrade, this log is in the temp directory of the system:

   WindowsTemp
   

   The filename is in this format: anyconnect-win-x.x.xxxx-k9-install-yyyyyyyyyyyyyy.log. Obtain the most recent file for the version of the client you want to install. The x.xxxx changes based on the version, such as 2.0.0343, and yyyyyyyyyyyyyy is the date and time of the install.

3. Obtain the PC system information file:
   1. From a Command Prompt/DOS box, type this:
      • Windows XP / Windows 2000:

        winmsd /nfo c:msinfo.nfo
        

      • Windows Vista:

        msinfo32 /nfo c:msinfo.nfo
        

      Note: After you type into this prompt, wait. It can take between two to five minutes for the file to complete.

   2. Obtain a systeminfo file dump from a Command Prompt:

      Windows XP and Windows Vista:

      systeminfo c:sysinfo.txt
      

Refer to AnyConnect: Corrupt Driver Database Issue in order to debug the driver issue.

Disconnection or Inability to Establish Initial Connection

If you experience connection problems with the AnyConnect client, such as disconnections or the inability to establish an initial connection, obtain these files:

• The configuration file from the ASA in order to determine if anything in the configuration causes the connection failure:

  From the console of the ASA, type write net x.x.x.x:ASA-Config.txt where x.x.x.x is the IP address of a TFTP server on the network.

  OR

  From the console of the ASA, type show running-config. Let the configuration complete on the screen, then cut-and-paste to a text editor and save.

• The ASA event logs:
  1. In order to enable logging on the ASA for auth, WebVPN, Secure Sockets Layer (SSL), and SSL VPN Client (SVC) events, issue these CLI commands:

     config terminal
     logging enable
     logging timestamp
     logging class auth console debugging
     logging class webvpn console debugging
     logging class ssl console debugging
     logging class svc console debugging

  2. Originate an AnyConnect session and ensure that the failure can be reproduced. Capture the logging output from the console to a text editor and save.
  3. In order to disable logging, issue no logging enable.
• The Cisco AnyConnect VPN Client log from the Windows Event Viewer of the client PC:
  1. Choose Start > Run.
  2. Enter:

     eventvwr.msc /s

  3. Right-click the Cisco AnyConnect VPN Client log, and select Save Log File as AnyConnect.evt.

     Note: Always save it as the .evt file format.

If the user cannot connect with the AnyConnect VPN Client, the issue might be related to an established Remote Desktop Protocol (RDP) session or Fast User Switching enabled on the client PC. The user can see the AnyConnect profile settings mandate a single local user, but multiple local users are currently logged into your computer. A VPN connection will not be established error message error on the client PC. In order to resolve this issue, disconnect any established RDP sessions and disable Fast User Switching. This behavior is controlled by the Windows Logon Enforcement attribute in the client profile, however currently there is no setting that actually allows a user to establish a VPN connection while multiple users are logged on simultaneously on the same machine. Enhancement request CSCsx15061 was filed to address this feature.

Note: Make sure that port 443 is not blocked so the AnyConnect client can connect to the ASA.

When a user cannot connect the AnyConnect VPN Client to the ASA, the issue might be caused by an incompatibility between the AnyConnect client version and the ASA software image version. In this case, the user receives this error message: The installer was not able to start the Cisco VPN client, clientless access is not available.

In order to resolve this issue, upgrade the AnyConnect client version to be compatible with the ASA software image.

When you log in the first time to the AnyConnect, the login script does not run. If you disconnect and log in again, then the login script runs fine. This is the expected behavior.

When you connect the AnyConnect VPN Client to the ASA, you might receive this error: User not authorized for AnyConnect Client access, contact your administrator.

This error is seen when the AnyConnect image is missing from the ASA. Once the image is loaded to the ASA, AnyConnect can connect without any issues to the ASA.

This error can be resolved by disabling Datagram Transport Layer Security (DTLS). Go to Configuration > Remote Access VPN > Network (Client) Access > AnyConnect Connection Profiles and uncheck the Enable DTLS check box. This disables DTLS.

The dartbundle files show this error message when the user gets disconnected: TUNNELPROTOCOLDPDMGR_ERROR_NO_DPD_RESPONSE:The secure gateway failed to respond to Dead Peer Detection packets. This error means that the DTLS channel was torn due to Dead Peer Detection (DPD) failure. This error is resolved if you tweak the DPD keepalives and issue these commands:

webvpn
   svc keepalive 30
   svc dpd-interval client 80
   svc dpd-interval gateway 80

The svc keepalive and svc dpd-interval commands are replaced by the anyconnect keepalive and anyconnect dpd-interval commands respectively in ASA Version 8.4(1) and later as shown here:

webvpn
anyconnect ssl keepalive 15
anyconnect dpd-interval client 5
anyconnect dpd-interval gateway 5

Problems with Passing Traffic

When problems are detected with passing traffic to the private network with an AnyConnect session through the ASA, complete these data-gathering steps:

1. Obtain the output of the show vpn-sessiondb detail svc filter name <username> ASA command from the console. If the output shows Filter Name: XXXXX, then gather the output for show access-list XXXXX. Verify that the access-list XXXXX does not block the intended traffic flow.
2. Export the AnyConnect statistics from AnyConnect VPN Client > Statistics > Details > Export (AnyConnect-ExportedStats.txt).
3. Check the ASA configuration file for nat statements. If Network Address Translation (NAT) is enabled, these must exempt data that returns to the client as a result of NAT. For example, to NAT exempt (nat 0) the IP addresses from the AnyConnect pool, use this on the CLI:

   access-list in_nat0_out extended permit ip any 10.136.246.0 255.255.255.0
   ip local pool IPPool1 10.136.246.1-10.136.246.254 mask 255.252.0.0
   nat (inside) 0 access-list in_nat0_out

4. Determine if the tunneled default gateway needs to be enabled for the setup. The traditional default gateway is the gateway of last resort for non-decrypted traffic.

   Example:

   
   !--- Route outside 0 0 is an incorrect statement.
   
   route outside 0 0 10.145.50.1
   route inside 0 0 10.0.4.2 tunneled

   For example, if the VPN Client needs to access a resource which is not in the routing table of the VPN Gateway, the packet is routed through the standard default gateway. The VPN gateway does not need the complete internal routing table in order to resolve this. The tunneled keyword can be used in this instance.

5. Verify if the AnyConnect traffic is dropped by the inspection policy of the ASA. You could exempt the specific application that is used by AnyConnct client if you implement the Modular Policy Framework of Cisco ASA. For example, you could exempt the skinny protocol with these commands.

   ASA(config)# policy-map global_policy
   ASA(config-pmap)#  class inspection_default
   ASA(config-pmap-c)# no inspect skinny

AnyConnect Crash Issues

Complete these data-gathering steps:

1. Ensure that the Microsoft Utility Dr Watson is enabled. In order to do this, choose Start > Run, and run Drwtsn32.exe. Configure this and click OK:

   Number of Instructions      : 25
   Number of Errors To Save    : 25
   Crash Dump Type             :  Mini
   Dump Symbol Table           : Checked
   Dump All Thread Contexts    : Checked
   Append To Existing Log File : Checked
   Visual Notification         : Checked
   Create Crash Dump File      : Checked

   When the crash occurs, gather the .log and .dmp files from C:Documents and SettingsAll UsersApplication DataMicrosoftDr Watson. If these files appear to be in use, then use ntbackup.exe.

2. Obtain the Cisco AnyConnect VPN Client log from the Windows Event Viewer of the client PC:
   1. Choose Start > Run.
   2. Enter:

      eventvwr.msc /s

   3. Right-click the Cisco AnyConnect VPN Client log, and select Save Log File As AnyConnect.evt.

      Note: Always save it as the .evt file format.

Fragmentation / Passing Traffic Issues

Some applications, such as Microsoft Outlook, do not work. However, the tunnel is able to pass other traffic such as small pings.

This can provide clues as to a fragmentation issue in the network. Consumer routers are particularly poor at packet fragmentation and reassembly.

Try a scaling set of pings in order to determine if it fails at a certain size. For example, ping -l 500, ping -l 1000, ping -l 1500, ping -l 2000.

It is recommended that you configure a special group for users that experience fragmentation, and set the SVC Maximum Transition Unit (MTU) for this group to 1200. This allows you to remediate users who experience this issue, but not impact the broader user base.

Problem

TCP connections hang once connected with AnyConnect.

Solution

In order to verify if your user has a fragmentation issue, adjust the MTU for AnyConnect clients on the ASA.

 ASA(config)#group-policy <name> attributes
                          webvpn
                              svc mtu 1200

Uninstall Automatically

Problem

The AnyConnect VPN Client uninstalls itself once the connection terminates. The client logs show that keep installed is set to disabled.

Solution

AnyConnect uninstalls itself despite that the keep installed option is selected on the Adaptive Security Device Manager (ASDM). In order to resolve this issue, configure the svc keep-installer installed command under group-policy.

Issue Populating the Cluster FQDN

Problem: AnyConnect client is pre-populated with the hostname instead of the cluster Fully Qualified Domain Name (FQDN).

When you have a load-balancing cluster set up for SSL VPN and the client attempts to connect to the cluster, the request is redirected to the node ASA and the client logs in successfully. After some time, when the client tries to connect to the cluster again, the cluster FQDN is not seen in the Connect to entries. Instead, the node ASA entry to which the client has been redirected is seen.

Solution

This occurs because the AnyConnect client retains the host name to which it last connected. This behavior is observed and a bug has been filed. For complete details about the bug, refer to Cisco bug ID CSCsz39019. The suggested workaround is to upgrade the Cisco AnyConnect to Version 2.5.

Backup Server List Configuration

A backup server list is configured in case the main server selected by the user is not reachable. This is defined in the Backup Server pane in the AnyConnect profile. Complete these steps:

1. Download the AnyConnect Profile Editor (registered customers only) . The file name is AnyConnectProfileEditor2_4_1.jar.
2. Create an XML file with the AnyConnect Profile Editor.
   1. Go to the server list tab.
   2. Click Add.
   3. Type the main server on the Hostname field.
   4. Add the backup server below the backup server list on the Host address field. Then, click Add.
3. Once you have the XML file, you need to assign it to the connection you use on the ASA.
   1. In ASDM, choose Configuration > Remote Access VPN > Network (Client) Access > AnyConnect Connection Profiles.
   2. Select your profile and click Edit.
   3. Click Manage from the Default Group Policy section.
   4. Select your group-policy and click Edit.
   5. Select Advanced and then click SSL VPN Client.
   6. Click New. Then, you need to type a name for the Profile and assign the XML file.
4. Connect the client to the session in order to download the XML file.

AnyConnect: Corrupt Driver Database Issue

This entry in the SetupAPI.log file suggests that the catalog system is corrupt:

W239 driver signing class list "C:WINDOWSINFcertclas.inf" was missing or invalid. Error 0xfffffde5: Unknown Error., assuming all device classes are subject to driver signing policy.

You can also receive this error message: Error(3/17): Unable to start VA, setup shared queue, or VA gave up shared queue.

You can receive this log on the client: "The VPN client driver has encountered an error".

Repair

This issue is due to Cisco bug ID CSCsm54689. In order to resolve this issue, make sure that Routing and Remote Access Service is disabled before you start AnyConnect. If this does not resolve the issue, complete these steps:

1. Open a command prompt as an Administrator on the PC (elevated prompt on Vista).
2. Run net stop CryptSvc.
3. Run:

   esentutl /p%systemroot%System32catroot2
   {F750E6C3-38EE-11D1-85E5-00C04FC295EE}catdb

4. When prompted, choose OK in order to attempt the repair.
5. Exit the command prompt.
6. Reboot.

Failed Repair

If the repair fails, complete these steps:

1. Open a command prompt as an Administrator on the PC (elevated prompt on Vista).
2. Run net stop CryptSvc.
3. Rename the %WINDIR%system32catroot2 to catroot2_old directory.
4. Exit the command prompt.
5. Reboot.

Analyze the Database

You can analyze the database at any time in order to determine if it is valid.

1. Open a command prompt as an Admimistrator on the PC.
2. Run:

   esentutl /g%systemroot%System32catroot2
   {F750E6C3-38EE-11D1-85E5-00C04FC295EE}catdb

   Refer to System Catalog Database Integrity for more information.

Error Messages

Error: Unable to Update the Session Management Database

While the SSL VPN is connected through a web browser, the Unable to Update the Session Management Database. error message appears, and the ASA logs show %ASA-3-211001: Memory allocation Error. The adaptive security appliance failed to allocate RAM system memory.

Solution 1

This issue is due to Cisco bug ID CSCsm51093. In order to resolve this issue, reload the ASA or upgrade the ASA software to the interim release mentioned in the bug. Refer to Cisco bug ID CSCsm51093 for more information.

Solution 2

This issue can also be resolved if you disable threat-detection on ASA if threat-detection is used.

Error: «Module c:Program FilesCiscoCisco AnyConnect VPN Clientvpnapi.dll failed to register»

When you use the AnyConnect client on laptops or PCs, an error occurs during the install:

"Module C:Program FilesCiscoCisco AnyConnect VPN Clientvpnapi.dll failed
to register..."

When this error is encountered, the installer cannot move forward and the client is removed.

Solution

These are the possible workarounds to resolve this error:

• The latest AnyConnect client is no longer officially supported with Microsoft Windows 2000. It is a registry problem with the 2000 computer. 
• Remove the VMware applications. Once AnyConnect is installed, VMware applications can be added back to the PC.
• Add the ASA to their trusted sites. 
• Copy these files from the ProgramFilesCiscoCiscoAnyconnect folder to a new folder and run the regsvr32 vpnapi.dll command prompt:
  • vpnapi.dll
  • vpncommon.dll
  • vpncommoncrypt.dll
• Reimage the operating system on the laptop/PC.

The log message related to this error on the AnyConnect client looks similar to this:

DEBUG: Error 2911:  Could not remove the folderC:Program FilesCiscoCisco AnyConnect
VPN Client.
The installer has encountered an unexpected error installing this package. This may
indicate a problem with this package. The error code is 2911. The arguments are:
C:Program FilesCiscoCisco AnyConnect VPN Client, ,
DEBUG: Error 2911:  Could not remove the folder C:Program FilesCiscoCisco AnyConnect
VPN Client.
The installer has encountered an unexpected error installing this package. This may
indicate a problem with this package. The error code is 2911. The arguments are:
C:Program FilesCiscoCisco AnyConnect VPN Client, ,
Info 1721. There is a problem with this Windows Installer package. A program required for
this install to complete could not be run. Contact your support personnel or package
vendor. Action: InstallHelper.exe, location: C:Program FilesCiscoCisco AnyConnect VPN
ClientInstallHelper.exe, command: -acl "C:Documents and SettingsAll UsersApplication
DataCiscoCisco AnyConnect VPN Client" -r

Error: «An error was received from the secure gateway in response to the VPN negotiation request. Please contact your network administrator»

When clients try to connect to the VPN with the Cisco AnyConnect VPN Client, this error is received.

This message was received from the secure gateway:

«Illegal address class» or «Host or network is 0» or «Other error»

Solution

The issue occurs because of the ASA local IP pool depletion. As the VPN pool resource is exhausted, the IP pool range must be enlarged.

Cisco bug ID is CSCsl82188 is filed for this issue. This error usually occurs when the local pool for address assignment is exhausted, or if a 32-bit subnet mask is used for the address pool. The workaround is to expand the address pool and use a 24-bit subnet mask for the pool.

Error: Session could not be established. Session limit of 2 reached.

When you try to connect more than two clients with the AnyConnect VPN Client, you receive the Login Failed error message on the Client and a warning message in the ASA logs that states Session could not be established. Session limit of 2 reached. I have the AnyConnect essential license on the ASA, which runs Version 8.0.4.

Solution 1

This error occurs because the AnyConnect essential license is not supported by ASA version 8.0.4. You need to upgrade the ASA to version 8.2.2. This resolves the error.

Note: Regardless of the license used, if the session limit is reached, the user will receive the login failed error message.

Solution 2

This error can also occur if the vpn-sessiondb max-anyconnect-premium-or-essentials-limit session-limit command is used to set the limit of VPN sessions permitted to be established. If the session-limit is set as two, then the user cannot establish more than two sessions even though the license installed supports more sessions. Set the session-limit to the number of VPN sessions required in order to avoid this error message.

Error: Anyconnect not enabled on VPN server while trying to connect anyconnect to ASA

You receive the Anyconnect not enabled on VPN server error message when you try to connect AnyConnect to the ASA.

Solution

This error is resolved if you enable AnyConnect on the outside interface of the ASA with ASDM. For more information on how to enable AnyConnect on the outside interface, refer to Configure Clientless SSL VPN (WebVPN) on the ASA.

Error:- %ASA-6-722036: Group client-group User xxxx IP x.x.x.x Transmitting large packet 1220 (threshold 1206)

The %ASA-6-722036: Group < client-group > User < xxxx > IP < x.x.x.x> Transmitting large packet 1220 (threshold 1206) error message appears in the logs of the ASA. What does this log mean and how is this resolved?

Solution

This log message states that a large packet was sent to the client. The source of the packet is not aware of the MTU of the client. This can also be due to compression of non-compressible data. The workaround is to turn off the SVC compression with the svc compression none command. This resolves the issue.

Error: The secure gateway has rejected the agent’s vpn connect or reconnect request.

When you connect to the AnyConnect Client, this error is received: "The secure gateway has rejected the agent's vpn connect or reconnect request. A new connection requires re-authentication and must be started manually. Please contact your network administrator if this problem persists. The following message was received from the secure gateway: no assigned address".

This error is also received when you connect to the AnyConnect Client: "The secure gateway has rejected the connection attempt. A new connection attempt to the same or another secure gateway is needed, which requires re-authentication. The following message was received from the secure gateway:Host or network is 0".

This error is also received when you connect to the AnyConnect Client: "The secure gateway has rejected the agent's vpn connect or reconnect request. A new connection requires a re-authentication and must be started manually. Please contact the network administrator if the problem persists. The following message was received from the secure gateway: No License".

Solution

The router was missing pool configuration after reload. You need to add the concerned configuration back to the router.

Router#show run | in pool

ip local pool SSLPOOL 192.168.30.2 192.168.30.254
   svc address-pool SSLPOO

The "The secure gateway has rejected the agent's vpn connect or reconnect request. A new connection requires a re-authentication and must be started manually. Please contact the network administrator if the problem persists. The following message was received from the secure gateway: No License" error occurs when the AnyConnect mobility license is missing. Once the license is installed, the issue is resolved.

Error: «Unable to update the session management database»

When you try to authenticate in WebPortal, this error message is received: "Unable to update the session management database".

Solution

This problem is related to memory allocation on the ASA. This issue is mostly encountered when the ASA Version is 8.2.1. Originally, this requires a 512MB RAM for its complete functionality.

As a permanent workaround, upgrade the memory to 512MB.

As a temporary workaround, try to free the memory with these steps:

1. Disable the threat-detection.
2. Disable SVC compression.
3. Reload the ASA.

Error: «The VPN client driver has encountered an error»

This is an error message obtained on the client machine when you try to connect to AnyConnect.

Solution

In order to resolve this error, complete this procedure in order to manually set the AnyConnect VPN agent to Interactive:

1. Right-click My Computer > Manage > Services and Applications > Services > and select the Cisco AnyConnect VPN Agent.
2. Right-click Properties, then log on, and select Allow service to interact with the desktop.

   This sets the registry Type value DWORD to 110 (default is 010) for the HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesvpnagent.

   Note: If this is to be used, then the preference would be to use the .MST transform in this instance. This is because if you set this manually with these methods, it requires that this be set after every install/upgrade process. This is why there is a need to identify the application that causes this problem.

   When Routing and Remote Access Service (RRAS) is enabled on the Windows PC, AnyConnect fails with the The VPN client driver has encountered an error. error message. In order to resolve this issue, make sure that Routing and RRAS is disabled before starting AnyConnect. Refer to Cisco bug ID CSCsm54689 for more information.

Error: «Unable to process response from xxx.xxx.xxx.xxx»

AnyConnect clients fail to connect to a Cisco ASA. The error in the AnyConnect window is "Unable to process response from xxx.xxx.xxx.xxx".

Solution

In order to resolve this error, try these workarounds:

• Remove WebVPN from the ASA and reenable it.<
• Change the port number to 444 from the existing 443 and reenable it on 443.

For more information on how to enable WebVPN and change the port for WebVPN, refer to this Solution.

Error: «Login Denied , unauthorized connection mechanism , contact your administrator»

AnyConnect clients fail to connect to a Cisco ASA. The error in the AnyConnect window is "Login Denied , unauthorized connection mechanism , contact your administrator".

Solution

This error message occurs mostly because of configuration issues that are improper or an incomplete configuration. Check the configuration and make sure it is as required to resolve the issue.

<

Error: «Anyconnect package unavailable or corrupted. Contact your system administrator»

This error occurs when you try to launch the AnyConnect software from a Macintosh client in order to connect to an ASA.

Solution

In order to resolve this, complete these steps:

1. Upload the Macintosh AnyConnect package to the flash of the ASA.
2. Modify the WebVPN configuration in order to specify the AnyConnect package that is used.

   webvpn
    svc image disk0:/anyconnect-macosx-i386-2.3.2016-k9.pkg 2
    svc image disk0:/anyconnect-macosx-powerpc-2.3.2016-k9.pkg 3

   The svc image command is replaced by the anyconnect image command in ASA Version 8.4(1) and later as shown here:

   hostname(config)#webvpn
   hostname(config-webvpn)#anyconnect image disk0:/
   anyconnect-win-3.0.0527-k9.pkg 1
   hostname(config-webvpn)#anyconnect image disk0:/
   anyconnect-macosx-i386-3.0.0414-k9.pkg 2

Error: «The AnyConnect package on the secure gateway could not be located»

This error is caused on the user’s Linux machine when it tries to connect to the ASA by launching AnyConnect. Here is the complete error:

"The AnyConnect package on the secure gateway could not be located. You may
be experiencing network connectivity issues. Please try connecting again."

Solution

In order to resolve this error message, verify whether the Operating System (OS) that is used on the client machine is supported by the AnyConnect client. 

If the OS is supported, then verify if the AnyConnect package is specified in the WebVPN configuration or not. See the Anyconnect package unavailable or corrupted section of this document for more information.

Error: «Secure VPN via remote desktop is not supported»

Users are unable to perform a remote desktop access. The Secure VPN via remote desktop is not supported error message appears.

Solution

This issue is due to these Cisco bug IDs: CSCsu22088 and CSCso42825. If you upgrade the AnyConnect VPN Client, it can resolve the issue. Refer to these bugs for more information.

Error: «The server certificate received or its chain does not comply with FIPS. A VPN connection will not be established»

When you attempt to VPN to the ASA 5505, the The server certificate received or its chain does not comply with FIPS. A VPN connection will not be established error message appears.

Solution

In order to resolve this error, you must disable the Federal Information Processing Standards (FIPS) in the AnyConnect Local Policy file. This file can usually be found at C:ProgramDataCiscoCisco AnyConnect VPN ClientAnyConnectLocalPolicy.xml. If this file is not found in this path, then locate the file at a different directory with a path such as C:Documents and SettingsAll UsersApplication DataCisco AnyConnectVPNClientAnyConnectLocalPolicy.xml. Once you locate the xml file, make changes to this file as shown here:

Change the phrase:

<FipsMode>true</FipsMode>

To:

<FipsMode>false</FipsMode>

Then, restart the computer. Users must have administrative permissions in order to modify this file.

Error: «Certificate Validation Failure»

Users are unable to launch AnyConnect and receive the Certificate Validation Failure error.

Solution

Certificate authentication works differently with AnyConnect compared to the IPSec client. In order for certificate authentication to work, you must import the client certificate to your browser and change the connection profile in order to use certificate authentication. You also need to enable this command on your ASA in order to allow SSL client-certificates to be used on the outside interface:

ssl certificate-authentication interface outside port 443

Error: «VPN Agent Service has encountered a problem and needs to close. We are sorry for the inconvenience»

When AnyConnect Version 2.4.0202 is installed on a Windows XP PC, it stops at updating localization files and an error message shows that the vpnagent.exe fails.

Solution

This behavior is logged in Cisco bug ID CSCsq49102. The suggested workaround is to disable the Citrix client.

Error: «This installation package could not be opened. Verify that the package exists»

When AnyConnect is downloaded, this error message is received:

"Contact your system administrator. The installer failed with the following error: This installation package could not be opened. Verify that the package exists and that you can access it, or contact the application vendor to verify that this is a valid Windows Installer package."

Solution

Complete these steps in order to fix this issue:

1. Remove any anti-virus software.
2. Disable the Windows firewall.
3. If neither Step 1 or 2 helps, then format the machine and then install.
4. If the problem still persists, open a TAC Case.

Error: «Error applying transforms. Verify that the specified transform paths are valid.»

This error message is recieved during the auto-download of AnyConnect from the ASA:

"Contact your system administrator. The installer failed with the following error:
Error applying transforms. Verify that the specified transform paths are valid."

This is the error message received when connecting with AnyConnect for MacOS:

"The AnyConnect package on the secure gateway could not be located. You may be
experiencing network connectivity issues. Please try connecting again."

Solution

Complete one of these workarounds in order to resolve this issue:

1. The root cause of this error might be due to a corrupted MST translation file (for example, imported). Perform these steps to fix this:
   1. Remove the MST translation table.
   2. Configure the AnyConnect image for MacOS in the ASA.
2. From the ASDM, follow the Network (Client) Access > AnyConnect Custom > Installs path and delete the AnyConnect package file. Make sure the package remains in Network (Client) Access > Advanced > SSL VPN > Client Setting.

If neither of these workarounds resolve the issue, contact Cisco Technical Support.

Error: «The VPN client driver has encountered an error»

This error is received:

The VPN client driver has encountered an error when connecting through Cisco
AnyConnect Client.

Solution

This issue can be resolved when you uninstall the AnyConnect Client, and then remove the anti-virus software. After this, reinstall the AnyConnect Client. If this resolution does not work, then reformat the PC in order to fix this issue.

Error: «A VPN reconnect resulted in different configuration setting. The VPN network setting is being re-initialized. Applications utilizing the private network may need to be restored.»

This error is received when you try to launch AnyConnect:

"A VPN reconnect resulted in different configuration setting. The VPN network
setting is being re-initialized. Applications utilizing the private network may
need to be restarted."

Solution

In order to resolve this error, use this:

group-policy <Name> attributes
			webvpn
				svc mtu 1200

The svc mtu command is replaced by the anyconnect mtu command in ASA Version 8.4(1) and later as shown here:

hostname(config)#group-policy <Name> attributes

hostname(config-group-policy)#webvpn
hostname(config-group-webvpn)#anyconnect mtu 500

AnyConnect Error While Logging In

Problem

The AnyConnect receives this error when it connects to the Client:

The VPN connection is not allowed via a local proxy. This can be changed
through AnyConnect profile settings.

Solution

The issue can be resolved if you make these changes to the AnyConnect profile:

Add this line to the AnyConnect profile:

<ProxySettings>IgnoreProxy</ProxySettings><
AllowLocalProxyConnections>
false</AllowLocalProxyConnections>

IE Proxy Setting is Not Restored after AnyConnect Disconnect on Windows 7

Problem

In Windows 7, if the IE proxy setting is configured for Automatically detect settings and AnyConnect pushes down a new proxy setting, the IE proxy setting is not restored back to Automatically detect settings after the user ends the AnyConnect session. This causes LAN issues for users who need their proxy setting configured for Automatically detect settings.

Solution

This behavior is logged in Cisco bug ID CSCtj51376. The suggested workaround is to upgrade to AnyConnect 3.0.

Error: AnyConnect Essentials can not be enabled until all these sessions are closed.

This error message is received on Cisco ASDM when you attempt to enable the AnyConnect Essentials license:

There are currently 2 clientless SSL VPN sessions in progress. AnyConnect
Essentials can not be enabled until all these sessions are closed.

Solution

This is the normal behavior of the ASA. AnyConnect Essentials is a separately licensed SSL VPN client. It is entirely configured on the ASA and provides the full AnyConnect capability, with these exceptions:

• No Cisco Secure Desktop (CSD) (including HostScan/Vault/Cache Cleaner)
• No clientless SSL VPN
• Optional Windows Mobile Support

This license cannot be used at the same time as the shared SSL VPN premium license. When you need to use one license, you need to disable the other.

Error: Connection tab on Internet option of Internet Explorer hides after getting connected to the AnyConnect client.

The connection tab on the Internet option of Internet Explorer hides after you are connected to the AnyConnect client.

Solution

This is due to the msie-proxy lockdown feature. If you enable this feature, it hides the Connections tab in Microsoft Internet Explorer for the duration of an AnyConnect VPN session. If you disable the feature, it leaves the display of the Connections tab unchanged.

Error: Few users getting Login Failed Error message when others are able to connect successfully through AnyConnect VPN

A few users receive the Login Failed Error message when others can connect successfully through the AnyConnect VPN.

Solution

This issue can be resolved if you make sure the do not require pre-authentication checkbox is checked for the users.

Error: The certificate you are viewing does not match with the name of the site you are trying to view.

During the AnyConnect profile update, an error is shown that says the certificate is invalid. This occurs with Windows only and at the profile update phase. The error message is shown here:

The certificate you are viewing does not match with the name of the site
you are trying to view.

Solution

This can be resolved if you modify the server list of the AnyConnect profile in order to use the FQDN of the certificate.

This is a sample of the XML profile:

<ServerList>
 <HostEntry>
    <HostName>vpn1.ccsd.net</HostName>
 </HostEntry>
</ServerList>

Note: If there is an existing entry for the Public IP address of the server such as <HostAddress>, then remove it and retain only the FQDN of the server (for example, <HostName> but not <Host Address>).

Cannot Launch AnyConnect From the CSD Vault From a Windows 7 Machine

When the AnyConnect is launched from the CSD vault, it does not work. This is attempted on Windows 7 machines.

Solution

Currently, this is not possible because it is not supported.

AnyConnect Profile Does Not Get Replicated to the Standby After Failover

The AnyConnect 3.0 VPN client with ASA Version 8.4.1 software works fine. However, after failover, there is no replication for the AnyConnect profile related configuration.

Solution

This problem has been observed and logged under Cisco bug ID CSCtn71662. The temporary workaround is to manually copy the files to the standby unit.

AnyConnect Client Crashes if Internet Explorer Goes Offline

When this occurs, the AnyConnect event log contains entries similar to these:

Description : Function:
CAdapterNetworkStateIfc::SetConnectedStateToConnected
File: .AdapterNetworkStateIfc.cpp
Line: 147
Invoked Function: InternetSetOption
Return Code: 12010 (0x00002EEA)
Description: The length is incorrect for the option type
Description : Function: CTransportWinHttp::InitTransport
File: .CTransportWinHttp.cpp
Line: 252
Invoked Function: CConnectedStateIfc::SetConnectedStateToConnected
Return Code: -25362420 (0xFE7D000C)
Description: CADAPTERNETWORKSTATEIFC_ERROR_SET_OPTION

Solution

This behavior is observed and logged under Cisco bug ID CSCtx28970. In order to resolve this, quit the AnyConnect application and relaunch. The connection entries reappear after relaunch.

Error Message: TLSPROTOCOL_ERROR_INSUFFICIENT_BUFFER

The AnyConnect client fails to connect and the Unable to establish a connection error message is received. In the AnyConnect event log, the TLSPROTOCOL_ERROR_INSUFFICIENT_BUFFER error is found.

Solution

This occurs when the headend is configured for split-tunneling with a very large split-tunnel list (approximately 180-200 entries) and one or more other client attributes are configured in the group-policy, such as dns-server.

In order to resolve this issue, complete these steps:

1. Reduce the number of entries in the split-tunnel list.
2. Use this configuration in order to disable DTLS:

   group-policy groupName attributes
     webvpn
       svc dtls none

For more information, refer to Cisco bug ID CSCtc41770.

Error Message: «Connection attempt has failed due to invalid host entry»

The Connection attempt has failed due to invalid host entry error message is received while AnyConnect is authenticated with the use of a certificate.

Solution

In order to resolve this issue, try either of these possible solutions:

• Upgrade the AnyConnect to Version 3.0.
• Disable Cisco Secure Desktop on your computer.

For more information, refer to Cisco bug ID CSCti73316.

Error: «Ensure your server certificates can pass strict mode if you configure always-on VPN»

When you enable the Always-On feature on AnyConnect, the Ensure your server certificates can pass strict mode if you configure always-on VPN error message is received.

Solution

This error message implies that if you want to use the Always-On feature, you need a valid sever certificate configured on the headend. Without a valid server certificate, this feature does not work. Strict Cert Mode is an option that you set in the AnyConnect local policy file in order to ensure the connections use a valid certificate. If you enable this option in the policy file and connect with a bogus certificate, the connection fails.

Error: «An internal error occurred in the Microsoft Windows HTTP Services»

This Diagnostic AnyConnect Reporting Tool (DART) shows one failed attempt:

******************************************
Date        : 03/25/2014
Time        : 09:52:21
Type        : Error
Source      : acvpnui
Description : Function: CTransportWinHttp::SendRequest
File: .CTransportWinHttp.cpp
Line: 1170
Invoked Function: HttpSendRequest
Return Code: 12004 (0x00002EE4)
Description: An internal error occurred in the Microsoft 
Windows HTTP Services 
*****************************************
Date        : 03/25/2014
Time        : 09:52:21
Type        : Error
Source      : acvpnui
Description : Function: ConnectIfc::connect
File: .ConnectIfc.cpp
Line: 472
Invoked Function: ConnectIfc::sendRequest
Return Code: -30015443 (0xFE36002D)
Description: CTRANSPORT_ERROR_CONN_UNKNOWN
******************************************
Date        : 03/25/2014
Time        : 09:52:21
Type        : Error
Source      : acvpnui
Description : Function: ConnectIfc::TranslateStatusCode
File: .ConnectIfc.cpp
Line: 2999
Invoked Function: ConnectIfc::TranslateStatusCode
Return Code: -30015443 (0xFE36002D)
Description: CTRANSPORT_ERROR_CONN_UNKNOWN
Connection attempt failed.  Please try again.
******************************************

Also, refer to the event viewer logs on the Windows machine.

Solution

This could be caused due to a corrupted Winsock connection. Reset the connection from the command promt with this command and restart your windows machine:

netsh winsock reset

Refer to the How to determine and to recover from Winsock2 corruption in Windows Server 2003, in Windows XP, and in Windows Vista knowledge base article for more information.

Error: «The SSL transport received a Secure Channel Failure.  May be a result of a unsupported crypto configuration on the Secure Gateway.»

This Diagnostic AnyConnect Reporting Tool (DART) shows one failed attempt:

******************************************
Date        : 10/27/2014
Time        : 16:29:09
Type        : Error
Source      : acvpnui
Description : Function: CTransportWinHttp::handleRequestError
File: .CTransportWinHttp.cpp
Line: 854
The SSL transport received a Secure Channel Failure.  May be a result of a unsupported crypto configuration on the Secure Gateway.
******************************************
Date        : 10/27/2014
Time        : 16:29:09
Type        : Error
Source      : acvpnui
Description : Function: CTransportWinHttp::SendRequest
File: .CTransportWinHttp.cpp
Line: 1199
Invoked Function: CTransportWinHttp::handleRequestError
Return Code: -30015418 (0xFE360046)
Description: CTRANSPORT_ERROR_SECURE_CHANNEL_FAILURE
******************************************
Date        : 10/27/2014
Time        : 16:29:09
Type        : Error
Source      : acvpnui
Description : Function: ConnectIfc::TranslateStatusCode
File: .ConnectIfc.cpp
Line: 3026
Invoked Function: ConnectIfc::TranslateStatusCode
Return Code: -30015418 (0xFE360046)
Description: CTRANSPORT_ERROR_SECURE_CHANNEL_FAILURE
Connection attempt failed.  Please try again.
******************************************

Solution

Windows 8.1 does not support RC4 according to the following KB update:

http://support2.microsoft.com/kb/2868725

Either configure DES/3DES ciphers for SSL VPN on the ASA using the command «ssl encryption 3des-sha1 aes128-sha1 aes256-sha1 des-sha1» OR edit the Windows Registry file on the client machine as mentioned below:

https://technet.microsoft.com/en-us/library/dn303404.aspx

Related Information

• Cisco ASA 5500 Series Adaptive Security Appliances
• AnyConnect VPN Client FAQ
• Cisco Secure Desktop (CSD) FAQ
• Cisco AnyConnect VPN Client
• Technical Support & Documentation — Cisco Systems

Добрый день, ни как не могу подключиться по ssl с помощью anyconnect 4.000061 с ОС Windows 8.1. С Android и Windows 7 нет проблем с подключение все работает.
Может кто сталкивался, не пойму в какую сторону копать? А то я чет приуныл совсем

Cisco IOS Software, 2800 Software (C2800NM-ADVSECURITYK9-M), Version 15.1(4)M9, RELEASE SOFTWARE (fc3)

Настройки
ip local pool SSLPool2 10.222.22.5 10.222.22.50

webvpn gateway WebKspGate
ip address Мой_адрес port 443
http-redirect port 80
ssl encryption rc4-md5
ssl trustpoint vlg-ksp-gw1.corp.kspvolg.ru
inservice
!
webvpn install svc usbflash0:/webvpn/anyconnect-win-4.0.00061-k9.pkg sequence 1
!
webvpn context SSLVPN
title «The Chamber of Control and Accounts of Volgograd»
login-photo none
logo file /webvpn/logo1.gif
color #003366
secondary-color #346699
title-color #003366
text-color #ffd700
ssl authenticate verify all
!
acl «webvpn-acl»
permit ip 192.168.70.0 255.255.255.0 192.168.70.0 255.255.255.0
permit ip 10.222.22.0 255.255.255.192 192.168.70.0 255.255.255.0
!
login-message «Enter your username and password»
!
policy group sslpolicy
url-list «KSPpages»
functions svc-enabled
filter tunnel webvpn-acl
svc address-pool «SSLPool2» netmask 255.255.255.192
svc default-domain «Mydomain»
svc keep-client-installed
svc rekey method new-tunnel
svc split include 192.168.70.0 255.255.255.0
svc split include 10.222.22.0 255.255.255.192
default-group-policy sslpolicy
aaa authentication list default
gateway WebKspGate
max-users 40
inservice
!
end

Логи клиента

******************************************

Date : 04/16/2015
Time : 11:40:56
Type : Information
Source : acvpnui

Description : An SSL VPN connection to My_address has been requested by the user.

******************************************

Date : 04/16/2015
Time : 11:40:56
Type : Warning
Source : acvpnui

Description : Function: ProfileMgr::getProfileNameFromHost
File: .ProfileMgr.cpp
Line: 808
No profile available for host My_address.

******************************************

Date : 04/16/2015
Time : 11:40:56
Type : Information
Source : acvpnui

Description : Function: ProfileMgr::getHostInitSettings
File: .ProfileMgr.cpp
Line: 888
Profile () not found. Using default settings.

******************************************

Date : 04/16/2015
Time : 11:40:56
Type : Information
Source : acvpnui

Description : Function: ProfileMgr::loadProfiles
File: .ProfileMgr.cpp
Line: 100
No profile is available.

******************************************

Date : 04/16/2015
Time : 11:40:56
Type : Warning
Source : acvpnui

Description : Function: ProfileMgr::getProfileNameFromHost
File: .ProfileMgr.cpp
Line: 808
No profile available for host My_address.

******************************************

Date : 04/16/2015
Time : 11:40:56
Type : Information
Source : acvpnui

Description : Using default preferences. Some settings (e.g. certificate matching) may not function as expected if a local profile is expected to be used. Verify that the selected host is in the server list section of the profile and that the profile is configured on the secure gateway.

******************************************

Date : 04/16/2015
Time : 11:40:56
Type : Warning
Source : acvpnui

Description : Function: ProfileMgr::getProfileNameFromHost
File: .ProfileMgr.cpp
Line: 808
No profile available for host My_address.

******************************************

Date : 04/16/2015
Time : 11:40:56
Type : Information
Source : acvpnui

Description : Function: ProfileMgr::getHostInitSettings
File: .ProfileMgr.cpp
Line: 888
Profile () not found. Using default settings.

******************************************

Date : 04/16/2015
Time : 11:40:56
Type : Information
Source : acvpnui

Description : Function: ApiCert::getCertList
File: .ApiCert.cpp
Line: 339
Number of certificates found: 0

******************************************

Date : 04/16/2015
Time : 11:40:56
Type : Information
Source : acvpnui

Description : Message type information sent to the user:
Contacting My_address.

******************************************

Date : 04/16/2015
Time : 11:40:56
Type : Information
Source : acvpnui

Description : Initiating VPN connection to the secure gateway https://My_address

******************************************

Date : 04/16/2015
Time : 11:40:56
Type : Information
Source : acvpnagent

Description : Using default preferences. Some settings (e.g. certificate matching) may not function as expected if a local profile is expected to be used. Verify that the selected host is in the server list section of the profile and that the profile is configured on the secure gateway.

******************************************

Date : 04/16/2015
Time : 11:40:56
Type : Information
Source : acvpnagent

Description : Function: CMainThread::processConnectNotification
File: .MainThread.cpp
Line: 11640
Received connect notification (host My_address, profile N/A)

******************************************

Date : 04/16/2015
Time : 11:40:56
Type : Information
Source : acvpnagent

Description : Function: CHostLocator::buildHostLocator
File: .UtilityHostLocator.cpp
Line: 332
FQDN: My_address.static-business.volgograd.ertelecom.ru

******************************************

Date : 04/16/2015
Time : 11:40:56
Type : Error
Source : acvpnagent

Description : Function: CAutoProxy::GetAutoProxyStrings
File: .ProxyAutoProxy.cpp
Line: 139
Invoked Function: WinHttpGetProxyForUrl
Return Code: 12180 (0x00002F94)
Description: WINDOWS_ERROR_CODE
SG URL https://My_address.static-business.volgograd.ertelecom.ru:443

******************************************

Date : 04/16/2015
Time : 11:40:56
Type : Information
Source : acvpnagent

Description : Function: CProxyCommonInfo::getProxyStrings
File: .ProxyProxyCommonInfo.cpp
Line: 802
Invoked Function: CAutoProxy::GetAutoProxyStrings
Return Code: -30539766 (0xFE2E000A)
Description: AUTOPROXY_ERROR_OPEN_FAILED

******************************************

Date : 04/16/2015
Time : 11:40:56
Type : Information
Source : acvpnagent

Description : Function: CMainThread::respondToConnectNotification
File: .MainThread.cpp
Line: 4950
The requested VPN connection to My_address will target the following IP protocols and addresses: primary — IPv4 (address My_address), secondary — N/A.

******************************************

Date : 04/16/2015
Time : 11:41:06
Type : Warning
Source : acvpnui

Description : Function: CWinHttpUtils::LogSecureStatusErrorFlagAsErrorCode
File: .UtilityWinHttpUtils.cpp
Line: 126
WinHttp certificate error: ERROR_WINHTTP_SECURE_CHANNEL_ERROR

******************************************

Date : 04/16/2015
Time : 11:41:06
Type : Error
Source : acvpnui

Description : Function: CTransportWinHttp::handleServerCertCheck
File: .CTransportWinHttp.cpp
Line: 2325
Invoked Function: ::WinHttpQueryOption
Return Code: 12019 (0x00002EF3)
Description: Дескриптор имеет неправильное состояние для запрошенного действия

******************************************

Date : 04/16/2015
Time : 11:41:06
Type : Error
Source : acvpnui

Description : Function: CTransportWinHttp::SendRequest
File: .CTransportWinHttp.cpp
Line: 1239
Invoked Function: HttpSendRequest
Return Code: 12175 (0x00002F8F)
Description: Произошла ошибка безопасности

******************************************

Date : 04/16/2015
Time : 11:41:06
Type : Error
Source : acvpnui

Description : Function: CTransportWinHttp::handleRequestError
File: .CTransportWinHttp.cpp
Line: 885
The SSL transport received a Secure Channel Failure. May be a result of a unsupported crypto configuration on the Secure Gateway.

******************************************

Date : 04/16/2015
Time : 11:41:06
Type : Error
Source : acvpnui

Description : Function: CTransportWinHttp::SendRequest
File: .CTransportWinHttp.cpp
Line: 1247
Invoked Function: CTransportWinHttp::handleRequestError
Return Code: -30015418 (0xFE360046)
Description: CTRANSPORT_ERROR_SECURE_CHANNEL_FAILURE

******************************************

Date : 04/16/2015
Time : 11:41:06
Type : Error
Source : acvpnui

Description : Function: ConnectIfc::sendRequest
File: .ConnectIfc.cpp
Line: 3209
Invoked Function: CTransport::SendRequest
Return Code: -30015418 (0xFE360046)
Description: CTRANSPORT_ERROR_SECURE_CHANNEL_FAILURE

******************************************

Date : 04/16/2015
Time : 11:41:06
Type : Error
Source : acvpnui

Description : Function: ConnectIfc::connect
File: .ConnectIfc.cpp
Line: 481
Invoked Function: ConnectIfc::sendRequest
Return Code: -30015418 (0xFE360046)
Description: CTRANSPORT_ERROR_SECURE_CHANNEL_FAILURE

******************************************

Date : 04/16/2015
Time : 11:41:06
Type : Error
Source : acvpnui

Description : Function: ConnectIfc::TranslateStatusCode
File: .ConnectIfc.cpp
Line: 3026
Invoked Function: ConnectIfc::TranslateStatusCode
Return Code: -30015418 (0xFE360046)
Description: CTRANSPORT_ERROR_SECURE_CHANNEL_FAILURE
Connection attempt failed. Please try again.

******************************************

Date : 04/16/2015
Time : 11:41:06
Type : Error
Source : acvpnui

Description : Function: ConnectMgr::doConnectIfcConnect
File: .ConnectMgr.cpp
Line: 1972
Invoked Function: ConnectIfc::connect
Return Code: -30015418 (0xFE360046)
Description: CTRANSPORT_ERROR_SECURE_CHANNEL_FAILURE

******************************************

Date : 04/16/2015
Time : 11:41:06
Type : Information
Source : acvpnui

Description : Message type warning sent to the user:
Connection attempt has failed.

******************************************

Date : 04/16/2015
Time : 11:41:06
Type : Error
Source : acvpnui

Description : Function: ConnectMgr::processIfcData
File: .ConnectMgr.cpp
Line: 2651
Content type (unknown) received.
Response type (failed) from My_address:

******************************************

Date : 04/16/2015
Time : 11:41:06
Type : Information
Source : acvpnui

Description : Function: ConnectMgr::processIfcData
File: .ConnectMgr.cpp
Line: 2777
Invoked Function: ConnectMgr::processIfcData
Return Code: -30015418 (0xFE360046)
Description: CTRANSPORT_ERROR_SECURE_CHANNEL_FAILURE
Connection attempt failed. Please try again.

******************************************

Date : 04/16/2015
Time : 11:41:06
Type : Information
Source : acvpnui

Description : Message type error sent to the user:
Connection attempt failed. Please try again.

******************************************

Date : 04/16/2015
Time : 11:41:06
Type : Error
Source : acvpnui

Description : Function: ConnectMgr::connect
File: .ConnectMgr.cpp
Line: 2059
ConnectMgr::processIfcData failed

******************************************

Date : 04/16/2015
Time : 11:41:06
Type : Error
Source : acvpnui

Description : Function: ConnectMgr::initiateConnect
File: .ConnectMgr.cpp
Line: 1185
Connection failed.

******************************************

Date : 04/16/2015
Time : 11:41:06
Type : Information
Source : acvpnagent

Description : Function: CMainThread::OnIpcMessageReceivedAtDepot
File: .MainThread.cpp
Line: 4291
Received connect failure notification (host My_address, profile N/A)

******************************************

Date : 04/16/2015
Time : 11:41:06
Type : Information
Source : acvpnui

Description : VPN state: Disconnected
Network state: Network Accessible
Network control state: Network Access: Available
Network type: Undefined

******************************************

Date : 04/16/2015
Time : 11:41:06
Type : Error
Source : acvpnui

Description : Function: ConnectMgr::run
File: .ConnectMgr.cpp
Line: 677
Invoked Function: ConnectMgr::initiateConnect
Return Code: -29622263 (0xFE3C0009)
Description: CONNECTMGR_ERROR_UNEXPECTED

******************************************

Date : 04/16/2015
Time : 11:41:06
Type : Warning
Source : acvpnui

Description : Function: CVpnApiShim::ClosePopup
File: .ApiShim.cpp
Line: 1983
No popup found of the given ID

******************************************

Date : 04/16/2015
Time : 11:41:06
Type : Error
Source : acvpnagent

Description : Function: CHostConfigMgr::determinePublicAddrCandidateFromDefRoute
File: .HostConfigMgr.cpp
Line: 1769
Invoked Function: CHostConfigMgr::FindDefaultRouteInterface
Return Code: -24117215 (0xFE900021)
Description: ROUTETABLE_ERROR_GETBESTROUTE_FAILED

******************************************

Date : 04/16/2015
Time : 11:41:06
Type : Warning
Source : acvpnagent

Description : Function: CHostConfigMgr::updatePotentialPublicAddresses
File: .HostConfigMgr.cpp
Line: 1914
Invoked Function: CHostConfigMgr::determinePublicAddrCandidateFromDefRoute
Return Code: -24117215 (0xFE900021)
Description: ROUTETABLE_ERROR_GETBESTROUTE_FAILED

******************************************

LazyProgrammer

2013-11-11 в 22:02

Я пытаюсь подключиться к VPN на рабочем месте, но Cisco AnyConnect не удается после инициализации подключения. Появляется ошибка, которая говорит, что The VPN client failed to establish a connectionзатем показывает другую ошибку, говорящую, AnyConnect was not able to establish a connection to the specified secure gateway. Please try connecting again. что я перепробовал все. Переустановка, перезапуск и другие вещи, такие как отключение ICS (Internet Connection Sharing). Я попробовал это на своем ноутбуке, и веб-установщик работал нормально. Он установил клиент и подключился совершенно нормально, так что это должно быть что-то с этим ПК. Я пытался понять это около 5 часов, и поиск в Google не помогает. Вот история сообщений от AnyConnect:

[11/11/2013 1:55:55 PM] Ready to connect. [11/11/2013 1:57:05 PM] Contacting ---.---.---.--- [11/11/2013 1:57:07 PM] Please enter your username and password. [11/11/2013 1:57:08 PM] User credentials entered. [11/11/2013 1:57:08 PM] Establishing VPN session... [11/11/2013 1:57:09 PM] Checking for profile updates... [11/11/2013 1:57:09 PM] Checking for product updates... [11/11/2013 1:57:10 PM] Checking for customization updates... [11/11/2013 1:57:10 PM] Performing any required updates... [11/11/2013 1:57:15 PM] Establishing VPN session... [11/11/2013 1:57:15 PM] Establishing VPN - Initiating connection... [11/11/2013 1:57:16 PM] Disconnect in progress, please wait... [11/11/2013 1:57:29 PM] Connection attempt has failed. [11/11/2013 1:59:31 PM] Ready to connect.

Я попытался отключить брандмауэр и антивирус. Я не думал, что это будет иметь значение, так как мой ноутбук использует тот же брандмауэр и антивирус, и мне не нужно было это отключать. Мой ноутбук использует 64-разрядную версию Windows 7 Home, а мой компьютер, на котором происходит сбой, использует 64-разрядную версию Windows 7 Ultimate.

---

6 ответов на вопрос

• Популярные
• Новые
• С комментариями
• Активные

Nathan

2014-08-22 в 22:33

The solution for me was to disable Internet Connection Sharing (ICS).

To resolve this issue:

1. Click the Windows Start button.
2. Click on Control Panel.
3. Set View by: to Category.
4. Click on View network status and tasks under Network and Internet.
5. Click on Change adapter settings.
6. Look for Shared in the Status column and right-click that connection and click Properties.
7. Click the Sharing tab.
8. Clear the Allow other network users to connect through this computer’s Internet connection check box.
9. Click OK.
10. Reinstall Cisco AnyConnect.

user919426

2016-02-11 в 19:01

If, your experience is similar to mine, where you have seemed to successfully authenticate, and then where you see the following two responses…

1) Pop-up shown as after what seems to be successful authentication

2) (Misleading) Message on AnyConnect taskbar window

.. it is quite likely that you have two users logged onto your client PC. That is, the local computer from which you are connecting to your office network..

The security risk is obvious. You can force a log-off on the other user, then it will work (**NB: Unsaved data for that user will be lost).

Abhijeet

2016-03-09 в 05:09

К сожалению, ничего из вышеперечисленного не помогло мне. Я отключил / включил адаптер беспроводной сети, и это решило проблему.

Evgeni Sergeev

2015-05-23 в 10:00

I see that disabling ICS did not work for the OP, but it worked for me and many others, according to various forums, it seems.

It may be a ThinkPad-specific issue. Lenovo published an advisory article indicating that their Access Connections software interferes with AnyConnect. The solution is to disable ICS. I don’t have a way to establish whether this is the actual reason for my problem, but the solution worked.

Nathan’s answer on this page didn’t work for me, because the Allow other network users[...] checkboxes were cleared for all the items anyway.

I disabled ICS this way:

1. Type services.msc into Windows’ menu after you press the Start button. Right click on the services.msc that appears after it’s finished searching, and Run as Administrator...

2. Find Internet Connection Sharing, stop it and set it to be launched Manually.

Mark Burgess

2016-02-09 в 15:55

У меня была эта проблема, и в итоге моя служба поддержки компании исправила ее, щелкнув значок свойств в окне «Cisco AnyConnect Secure Mobility Client».

На вкладке «Настройки» в появившемся окне найдите флажок «Проверять наличие обновлений для VPN-подключения» и убедитесь, что он установлен. Затем при подключении к VPN клиент проверяет наличие доступных обновлений и устанавливает себя.

Я не смог найти эту информацию в тот же день, но если бы я смог, я был бы в состоянии повторно подключиться к VPN компании — вместо этого я получил мешок, спасибо Cisco!

Bhav

2016-08-17 в 20:03

Ни один из вариантов выше не работал для меня. Для меня все сводилось к захвату Wireshark. Оказывается, что большинство пользователей VPN пытались подключиться к серверу wpad через wpad.mydomain.com. У нас есть поиск по шаблону на mydomain.com, поэтому wpad.mydomain.com разрешается там. Очевидно, что не удалось получить настройки прокси с этого IP-адреса и возникла ошибка «VPN-клиенту не удалось установить соединение»

Чинить:

1. Нажмите на Start Menu
2. выберите Control Panel
3. Нажмите на Internet Options
4. Перейти на Connectionsвкладку
5. Нажмите LAN Settingsкнопку
6. Uncheck Automatically Detect Settings
7. Нажмите OK,OK
8. перезапустите Cisco AnyConnect и попробуйте снова

If you are facing Cisco AnyConnect Connection attempt failed error in your Windows 10 computer when you try to use or connect to Cisco AnyConnect, then you are in right place for the solution. Here, you will be guided with easy steps/methods to resolve the issue. Let’s starts the discussion.

‘Cisco AnyConnect’: Cisco offers Cisco AnyConnect Secure Mobility to extend network perimeter to remote endpoints, enabling the seamless integration of web filtering services offered by Web Security appliance. Cisco AnyConnect Secure Mobility provides an innovative new way to protect mobile users on computer-based or smart-phone platforms, providing a more seamless, always protected experience for end users and comprehensive policy enforcement for IT administrators.

However, several Windows 10 users reported they faced Cisco AnyConnect Connection attempt failed error or ‘Connection attempt failed’ error when they tried to use Cisco AnyConnect or running VPN (Virtual Private Network) on Windows 10 computer. This issue indicates you are unable to run or use Cisco AnyConnect VPN in your Windows computer for some reasons. There could be several reasons behind the issue including required admisntrator permission is not given to Cisco AnyConnect or Cisco AnyConnect is no running in compatibility mode, enabled Hyper-V and some other issues in  your computer.

One possible way to fix the issue is to provide administrator permission to Cisco AnyConnect Connection and allow running in compatibility mode also. Another possible way to fix the issue is to disable Microsoft Hyper-V feature in your Windows computer, and check if it works for you. It is possible to fix the issue with our instructions. Let’s go for the solution.

How to fix Cisco AnyConnect Connection attempt failed error in Windows 10?

Method 1: Fix Cisco AnyConnect Connection attempt failed error with ‘PC Repair Tool’

‘PC Repair Tool’ is easy & quick way to find and fix BSOD errors, DLL errors, EXE errors, problems with programs/applications, malware or viruses issues, system files or registry issues, and other system issues with just few clicks.

Method 2: Run Cisco AnyConnect in Compatibility Mode

One possible way to fix the issue is to set Cisco AnyConnect program to run in compatibility mode in your computer.

Step 1: Open ‘File Explorer’ and navigate to ‘C:Program Files (x86)CiscoCisco AnyConnect Secure Mobility Client’ path

Step 2: Find and right-click on ‘vpnui.exe’, and select ‘Properties’. In ‘Properties’ window, click ‘Compatibility’ tab, tick ‘Run this program in compatibility mode for’ checkbox and select ‘Windows 8’ or prior from dropdown, tick ‘Run this program as an administrator’ checkbox and then hit ‘Apply’ and ‘Ok’ button to save the changes.

Step 3: Once done, restart your computer and check if you can run and use Cisco AnyConnect in your Windows 10 computer without any issue.

Method 3: Disable Microsoft Hyper-V feature in Windows 10

Another possible way to fix the issue is to disable Microsoft Hyper-V feature in your Windows 10 computer.

Step 1: Open ‘Control Panel’ in Windows PC via Windows Search Box and go to ‘Uninstall a Program > Programs & Features > Turn Windows Features ON or OFF’

Step 2: In ‘Windows Features’ window, find and untick the checkboxes relating to ‘Hyper-V’ and then hit ‘OK’ button to save the changes. Once done, restart your computer and check if the error is resolved.

Method 4: Stop ‘Internet Connection Sharing’ service

This issue can be resolved by stopping ‘Internet Connection Sharing’ service in your computer.

Step 1: Open ‘Services’ app in Windows PC via Windows Search Box

Step 2: Find and double-click on ‘Internet Connection Sharing’ service to open its ‘Properties’

Step 3: In ‘Properties’ window, select ‘Manual’ from ‘Startup Type’ dropdown and hit ‘Stop’ button under ‘Service Status’ section

Step 4: Finally, click ‘Apply’ and ‘Ok’ button to save the changes. Once done, restart your computer and check if the error is resolved.

Method 5: Install pending Windows update

Updating Windows OS to latest update version can resolve the issue.

Step 1: Open ‘Settings’ App in Windows PC and go to ‘Update & Security > Windows Update’ and click ‘Check for updates’ button

Step 2: Download and install all available updates or pending updates and once updated, restart your computer and check if the error is resolved.

Method 6: Disable Internet Explorer’s ability to Work Offiline via Registry Editor

Step 1: Open ‘Registry Editor’ in Windows PC via Windows Search Box and navigate to following path

HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionInternet Settings

Step 2: Now, double-click on ‘GlobalUserOffline’ DWORD key in right pane to edit, set ‘Base’ to ‘Hexadecimal’, set value data to ‘0’, and then hit ‘Ok’ to save the changes. Once done, restart your computer and check if the error is resolved.

Conclusion

I am sure this post helped you on How to fix Cisco AnyConnect Connection attempt failed error in Windows 10 with several easy steps/methods. You can read & follow our instructions to do so. That’s all. For any suggestions or queries, please write on comment box below.