Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Users might experience few discrepancies in Search results. We are working on this on our side. We apologize for the inconvenience it may have caused.
Bronze

DTLS configured for 442 but not listening

Hi,

I've asked TAC to solve this for me but they don't have an answer so far. If anyone has an idea what might be wrong, please advise

sh asp table socket output proves DTLS is not listening on port 442 but configuration is setup for 442.

clients are not getting DTLS tunnels which are important for AnyConnect perfomance which suffers otherwise

ASA 9.1(2) code

AnyConnect 3.1.04059 client

Protocol  Socket    State      Local Address      Foreign Address

SSL       00005558  LISTEN     10.10.2.1:444      0.0.0.0:*                                   

SSL       0000b4d8  LISTEN     a.b.c.d:444        0.0.0.0:*                                   

SSL       0000d1c8  LISTEN     e.f.g.h:444        0.0.0.0:*                                   

TCP       00011088  LISTEN     a.b.c.d:22         0.0.0.0:*                                   

TCP       00017bb8  LISTEN     e.f.g.h:22         0.0.0.0:*                                   

TCP       00018bb8  LISTEN     10.10.2.1:22       0.0.0.0:*                                   

SSL       0001cf28  LISTEN     a.b.c.d:442        0.0.0.0:*                                   

DTLS      00023268  LISTEN     a.b.c.d:443        0.0.0.0:*

webvpn

port 442

enable outside1

dtls port 442

anyconnect-essentials

anyconnect image disk0:/anyconnect-win-3.1.04059-k9.pkg 2

anyconnect profiles MCo-MDT disk0:/mdt-vpn-policy.xml

anyconnect profiles MCo-VPN disk0:/mco-vpn.xml

anyconnect enable

tunnel-group-list enable

group-policy DfltGrpPolicy attributes

vpn-idle-timeout 60

webvpn

  anyconnect mtu 1200

  anyconnect ssl keepalive none

  anyconnect dpd-interval client none

  anyconnect dpd-interval gateway none

  anyconnect ssl df-bit-ignore enable

  anyconnect routing-filtering-ignore enable

group-policy mdt-vpn-policy internal

group-policy mdt-vpn-policy attributes

dns-server value 10.3.3.5 10.3.3.10

vpn-idle-timeout 60

vpn-filter value mdt_vpn

vpn-tunnel-protocol ssl-client

split-tunnel-policy tunnelspecified

split-tunnel-network-list value split-tunnel

default-domain value <>

address-pools value mdt-vpn-pool

webvpn

  anyconnect profiles value MCo-MDT type user

1 REPLY
Bronze

Re: DTLS configured for 442 but not listening

Known bug. Thank you TAC.

disable and re-enable to work around.

conf t

webvpn

no enable outside1

no port 442

no dtls port 442

enable outside1

port 442

dtls port 442

561
Views
0
Helpful
1
Replies
CreatePlease to create content