topic Re: Cisco AnyConnect connection failures in Everything else

Cisco AnyConnect connection failures

buckwem — Sun, 19 Sep 2021 17:22:51 GMT

I have been having problems with Cisco AnyConnect for the past few months with failed connections giving the message "The VPN client agent SSL engine encountered an error. Please restart your computer or device, then try again. If the issue persists, please contact your network administrator." It can take 3, 4 or even 5 connection attempted but it finally connects.

Cisco introduced a defect into AnyConnect that DTLS failures when using Plusnet. The details are here: https://quickview.cloudapps.cisco.com/quickview/bug/CSCvz55373

The conditions you may see this are:
1. DTLS is enabled.
2. DPD is enabled.
3. All desktop and mobile platforms except UWP
4. Versions = v4.10.010xx and v4.10.02xx

The PlusNet Broadband Firewall and Safeguard are off but I suspect the traffic is still being routed through this service and the changes it makes causes the connection failure.

On rare occasions you may get a big red error saying "Untrusted Server Blocked!" indicating a bigger security issue of TLS certificate hijacking.

The fix is to turn off DTLS which is not something that should be done. It's currently a Sev 2 defect but may not get fixed until next year.

For now, anyone using Cisco AnyConnect will have to put up with these errors until Cisco fix AnyConnect or Plusnet change their security software.

Re: Cisco AnyConnect connection failures

dvorak — Sun, 19 Sep 2021 17:56:24 GMT

Moderators Note

This topic has been moved from Fibre to Everything Else

Re: Cisco AnyConnect connection failures

crispy235 — Thu, 28 Oct 2021 09:14:13 GMT

Not sure if this will help anyone but for months every time I have visited my mother's and needed to work I have had to use the neighbour's wifi (who strangely is also on plusnet) because my Cisco VPN never worked (it authenticates fine and all appears to be OK but when you try to connect to any machine using remote desktop it just fails). I have spent ages trying to fix it but last night tried using the free Shrewsoft VPN (which allows you to import a Cisco profile). It now works perfectly. This may or may not apply to AnyConnect but in my case it's quite an old Cisco VPN version.

Re: Cisco AnyConnect connection failures

buckwem — Thu, 28 Oct 2021 09:42:19 GMT

The reason it will work is that it removes the security that Plusnet interferes with. In our implementation we are using the Umbrella security extension and it will fail to connect if using another VPN without the pre-checks.

Re: Cisco AnyConnect connection failures

crispy235 — Thu, 28 Oct 2021 10:48:29 GMT

Thanks a lot for the reply although I must admit I don't understand completely! So this other third party VPN client works differently from Cisco in terms of handshaking etc?

Re: Cisco AnyConnect connection failures

buckwem — Thu, 28 Oct 2021 10:55:42 GMT

I just looked and there is a new version that fixes the problem. I am trying to understand when our CIO team are going to roll it out.