Cisco Anyconnect Drops Wifi Connection

I have a user reporting that when they connect to the VPN they loose their internet connection. They can still access company intranet. We use Cisco anyconnect to access the VPN. They are using Windows 7. Full disclosure. This is my first VPN troubleshooting ticket. Just for the record, I have 1 remote user with a Satellite internet connection and is always having trouble maintaining the Cisco VPN. It seems to be worse at certain times of the day. I played around with all the settings and never found a solution.

Something strange would happen when I connected to a Firepower 2130 running Firepower Threat Defense with Cisco AnyConnect.

Basically, the AnyConnect client would contact the VPN gateway just fine, prompt for user credentials, authenticate and connect but then literally after about 3 seconds of being connected it would immediately drop and attempt to reconnect again. This would typically happen about two or three times before the VPN client would make the connection and stay connected and stable. I actually never had to re-enter my user credentials during this connect / reconnect process.

While there are some topics discussed that I found by doing a couple of searches, none of them explicitly talked about Firepower 2100 series appliances, Firepower Threat Defense, or Firepower Management Center (FMC) in particular. Most articles or forum discussions were centered around ASA Firewall topics, but I think the concept behind the fix is the same.

A little bit of background regarding what device(s) are at play here:

Cisco Firepower Management Center 6.2.3.7-51 running on VMware
Cisco Firepower 2130 Next Generation Firewall on Firepower Threat Defense 6.2.3.7-51
Cisco AnyConnect Secure Mobility Client 4.5.05030 on Windows 10 64-bit

Let’s take a look at some logs to see the problem in action.

Some information seemed to point to DTLS as being the problem and while the link here suggests this on ASA releases 9.0 and 9.1, the topic of MTU size caught my eye. Some other posts I read mentioned MTU as well, so I figured I would change the default MTU size from 1406 to something different and see if this helped, and it did.

Let’s see the problem first hand. Here are the message history logs from within Cisco AnyConnect: Papenmeier usb devices driver download for windows 10.

11:05:30 AM Contacting vpn.example.com.11:05:36 AM User credentials entered.11:05:37 AM Establishing VPN session..11:05:37 AM The AnyConnect Downloader is performing update checks..11:05:37 AM Checking for profile updates..11:05:37 AM Checking for product updates..11:05:37 AM Checking for customization updates..11:05:37 AM Performing any required updates..11:05:37 AM The AnyConnect Downloader updates have been completed.11:05:37 AM Establishing VPN session..11:05:37 AM Establishing VPN - Initiating connection..11:05:37 AM Establishing VPN - Examining system..11:05:37 AM Establishing VPN - Activating VPN adapter..11:05:41 AM Establishing VPN - Configuring system..11:05:41 AM Establishing VPN..11:05:41 AM Connected to vpn.example.com.11:05:59 AM Reconnecting to vpn.example.com..11:06:00 AM Establishing VPN - Examining system..11:06:05 AM Establishing VPN - Activating VPN adapter..11:06:09 AM Establishing VPN - Configuring system..11:06:09 AM Establishing VPN..11:06:09 AM Connected to vpn.example.com.11:06:09 AM Reconnecting to vpn.example.com..11:06:09 AM Establishing VPN - Examining system..11:06:09 AM Establishing VPN - Activating VPN adapter..11:06:09 AM Establishing VPN - Configuring system..11:06:09 AM Establishing VPN..11:06:09 AM Connected to vpn.example.com.

What is the workaround to solve this “reconnecting” behavior?

Let’s go into FMC and change the MTU settings for the Group Policy associated with your Remote Access VPN setup.

Navigate to Objects tab > VPN > Group Policy > NAME OF YOUR RA VPN GROUP POLICY > Click on the pencil “Edit” icon.

Once you are on the Edit Group Policy screen, go to the “AnyConnect” Tab > SSL Settings Drivers medialas. > Change MTU Size to 1300 Bytes.

Don’t forget to click on Save at the bottom and then deploy the changes to the firewall that AnyConnect clients are connecting to. Grab some coffee, and check the latest weather update (since FMC takes a while to push policy… ugh). Once it is done, let’s connect through VPN and take a look at those AnyConnect message history entries again.

The logs show that the VPN connection was made, and then no reconnects were tried after the successful connection. I let the client stay connected for a few minutes just to make sure everything was OK, then manually disconnected at 11:27:06.

While leaving the MTU setting at 1300 bytes may not be possible for whatever environment you are working in, for now this seems to be working just fine. At any given time we have only about 50 concurrent AnyConnect sessions, so it’s a fairly low volume of remote workers that are being supported. If any long-term issues arise from this setup, i’ll be sure to update this post.

Why Does Cisco Anyconnect Keep Disconnecting

Thanks for reading, good luck!

I enjoy the new VPN client, it’s small and fast, however I hated that you can’t save profiles in the drop down list like you could in the traditional VPN client.

This has been bothering for a long time and kept finding conflicting information on if this was possible or not. Finally got it to work.

This is for version 3.1x and Windows 7 let me know if this works for your version and OS.

Create a preferences.xml file in C:ProgramDataCiscoCisco AnyConnect Secure Mobility ClientProfile
Use this format

<?xml version='1.0' encoding='UTF-8'?>

Cisco Anyconnect Drops Wifi Connection After Sleep

<AnyConnectProfile xmlns='http://schemas.xmlsoap.org/encoding/'>
<ServerList>
<HostEntry>
<User>dclouduser</User>
<SecondUser></SecondUser>
<ClientCertificateThumbprint></ClientCertificateThumbprint>
<ServerCertificateThumbprint></ServerCertificateThumbprint>
<HostName>dCloud</HostName>
<HostAddress>dcloud-rtp-anyconnect.cisco.com</HostAddress>
<Domain></Domain>
<Group>ssl_url</Group>
<ProxyHost></ProxyHost>
<ProxyPort></ProxyPort>
<SDITokenType>none</SDITokenType>
<ControllablePreferences>
<LocalLanAccess>true</LocalLanAccess></ControllablePreferences>
</HostEntry>

<HostEntry>
<User>dmacias</User>
<SecondUser></SecondUser>
<ClientCertificateThumbprint></ClientCertificateThumbprint>
<ServerCertificateThumbprint></ServerCertificateThumbprint>
<HostName>Speech-Soft</HostName>
<HostAddress>vpn.dmacias.com</HostAddress>
<Domain></Domain>
<Group>ssl_url</Group>
<ProxyHost></ProxyHost>
<ProxyPort></ProxyPort>
<SDITokenType>none</SDITokenType>
<ControllablePreferences>
<LocalLanAccess>true</LocalLanAccess></ControllablePreferences>
</HostEntry>
</ServerList>

</AnyConnectProfile>

Save the file.
Restart the connectivity client.
Enjoy

Cisco Anyconnect Lose Internet Connection

~david

Cisco Anyconnect Drops Wifi Connection Problems

EDIT 01/18/2017: This also works with Cisco AnyConnect 4.x!