Hi
AnyConnect 3.1.05152 and 3.1.04063 reconnects about every minute on Windows 7 x64 and Windows 8.1 x32. This issue happens whether I'm connected via cable or wireless. Sometimes I see strange messages on the routers console depending on the client I use:
169BEE80: 16030300 89010000 85030352 BD99CFBD ...........R=.O=
169BEE90: DBFF9A0E BFC9ADB6 8F77265E 80728829 [...?I-6.w&^.r.)
169BEEA0: 42F01ED7 6999F45E 0CDCB800 0026003C Bp.Wi.t^.\8..&.<..
Gateway: Cisco 897VAW router, Cisco IOS Software, C800 Software (C800-UNIVERSALK9-M), Version 15.4(1)T, RELEASE SOFTWARE (fc2). The problem also exists in with 15.3.3M1.
For troubleshooting purposes I connected the router and the client on the same subnet. On the client I'm pinging a loopback address of the router.
Message history in AnyConnect:
[12/27/13 16:33:21] Establishing VPN...
[27.12.2013 16:33:21] Connected to 192.168.x.y.
[27.12.2013 16:33:50] Reconnecting to 192.168.x.y...
[27.12.2013 16:33:50] Connected to 192.168.x.y.
[27.12.2013 16:34:20] Reconnecting to 192.168.x.y...
[27.12.2013 16:34:22] Connected to 192.168.x.y.
[27.12.2013 16:34:52] Reconnecting to 192.168.x.y...
[27.12.2013 16:34:56] Connected to 192.168.x.y.
[27.12.2013 16:35:26] Reconnecting to 192.168.x.y...
[27.12.2013 16:35:43] Establishing VPN - Examining system...
[27.12.2013 16:35:43] Establishing VPN - Activating VPN adapter...
[27.12.2013 16:35:43] Establishing VPN - Configuring system...
[27.12.2013 16:35:44] Establishing VPN...
[27.12.2013 16:35:44] Connected to 192.168.x.y.
[27.12.2013 16:36:13] Reconnecting to 192.168.x.y...
[27.12.2013 16:36:13] Connected to 192.168.x.y.
[27.12.2013 16:36:43] Reconnecting to 192.168.x.y...
[27.12.2013 16:36:45] Connected to 192.168.x.y.
[27.12.2013 16:37:15] Reconnecting to 192.168.x.y...
[27.12.2013 16:37:20] Connected to 192.168.x.y.
[27.12.2013 16:37:49] Reconnecting to 192.168.x.y...
[27.12.2013 16:38:06] Establishing VPN - Examining system...
[27.12.2013 16:38:06] Establishing VPN - Activating VPN adapter...
[27.12.2013 16:38:06] Establishing VPN - Configuring system...
[27.12.2013 16:38:07] Establishing VPN...
[27.12.2013 16:38:07] Connected to 192.168.x.y.
[27.12.2013 16:38:36] Reconnecting to 192.168.x.y...
[27.12.2013 16:38:36] Connected to 192.168.x.y.
[27.12.2013 16:39:06] Reconnecting to 192.168.x.y...
[27.12.2013 16:39:08] Connected to 192.168.x.y.
[27.12.2013 16:39:38] Reconnecting to 192.168.x.y...
[...]
Messages found via DART:
Date : 12/27/2013
Time : 16:33:50
Type : Error
Source : acvpnagent
Description : Function: CTlsTunnelMgr::OnTunnelReadComplete
File: .\TlsTunnelMgr.cpp
Line: 1690
Invoked Function: CTunnelStateMgr::readTunnel
Return Code: -31588336 (0xFE1E0010)
Description: SOCKETTRANSPORT_ERROR_TRANSPORT_SHUTDOWN:The socket was shutdown by the operating system or a remote peer.
callback
******************************************
Date : 12/27/2013
Time : 16:33:50
Type : Warning
Source : acvpnagent
Description : Tunnel level reconnect reason code 6:
Disruption of the VPN connection to the secure gateway.
Caching the default reconnect reason for SSL
******************************************
Date : 12/27/2013
Time : 16:33:50
Type : Information
Source : acvpnagent
Description : The Primary SSL connection to the secure gateway is being re-established.
******************************************
Date : 12/27/2013
Time : 16:33:50
Type : Information
Source : acvpnagent
Description : The VPN client has sent the following close message to the gateway:
Reconnecting to recover from error.
******************************************
Date : 12/27/2013
Time : 16:33:50
Type : Warning
Source : acvpnagent
Description : A SSL Alert was sent by the client during a write operation. Severity: warning Description: close notify
Example session on router:
show webvpn session user xy context all detail
Session Type : Full Tunnel
Client User-Agent : AnyConnect Windows 3.1.04063
Username : xy Num Connection : 1
Public IP : 192.168.x.x VRF Name : None
Context : PLUTO Policy Group : VPN-POLICY
Last-Used : 00:00:00 Created : 16:10:49.136 UTC Fri Dec 27 2013
Session Timeout : Disabled Idle Timeout : 2100
DPD GW Timeout : 300 DPD CL Timeout : 300
Address Pool : webvpn-pool MTU Size : 1399
Rekey Time : 3600 Rekey Method :
Lease Duration : 43200
Tunnel IP : 192.168.30.14 Netmask : 255.255.255.0
Tunnel-mode filte : VPN-ACL
Rx IP Packets : 85 Tx IP Packets : 175
CSTP Started : 00:00:04 Last-Received : 00:00:00
CSTP DPD-Req sent : 0 Virtual Access : 1
Msie-ProxyServer : None Msie-PxyPolicy : Disabled
Msie-Exception :
Split Include : 192.168.34.0 255.255.255.0
192.168.30.0 255.255.255.0
Client Ports : 49390
Relevant router configuration:
aaa new-model
aaa authentication login WEBVPN local-case
username xy@domain ...
crypto vpn anyconnect flash:/webvpn/anyconnect-win-3.1.04063-k9.pkg sequence 1
webvpn gateway STARGATE
ip interface Vlan1 port 443
ssl encryption aes256-sha1 rsa-dhe-aes128-sha1 rsa-dhe-aes256-sha1
ssl trustpoint webvpn
inservice
!
webvpn context PLUTO
[...]
acl "VPN-ACL"
permit ip 192.168.30.0 255.255.255.0 ...
!
acl "DENY-ACL"
deny ip any any
aaa authentication list WEBVPN
aaa authentication domain @domain
gateway STARGATE
max-users 5
!
ssl authenticate verify all
!
inservice
!
policy group VPN-POLICY
acl "DENY-ACL"
functions svc-enabled
functions svc-required
filter tunnel VPN-ACL
svc address-pool "webvpn-pool" netmask 255.255.255.255
svc split include 192.168.34.0 255.255.255.0
svc split include 192.168.30.0 255.255.255.0
default-group-policy VPN-POLICY
I've already tried to use rc4-md5 as SSL encryption in the gateway, but it didn't solve the problem.
How can I fix this problem?
