Cisco Anyconnect 3.1



Contents

Introduction

I saw someone said that AnyConnect 3.1 added extra certificate verification than 3.0, which makes 3.1 not compatible with ocserv. The latest version of AnyConnect for iOS is 3.0.12119, but for PC/Mac 3.1.05182. I tried to find clients of AnyConnect 3.0.11042/3.0.11046, only two can be found, and MD5 checksum are same no matter where I downloaded. Cisco Anyconnect Secure Mobility Client version 3.1.06073: Security vulnerabilities, exploits, vulnerability statistics, CVSS scores and references (e.g.: CVE-2009-1234 or 2010-1234 or 20101234) Log In Register. The AnyConnect 3.1.14018 release is the last maintenance release for 3.1.x. 'Files signed before January 1st, 2016 will be valid until January 1st, 2017.

This document discusses the specific scenario where the AnyConnect client might reconnect to the Adaptive Security Appliance (ASA) in exactly one minute. The users might not be able to receive traffic over the Transport Layer Security (TLS) tunnel until AnyConnect reconnects. This is dependent upon a few other factors which are discussed in this document.

Affected Components

  • ASA Release 9.0 or Release 9.1
  • AnyConnect Client Release 3.0 or Release 3.1

Symptoms

Cisco Anyconnect 3.1

In this example, the AnyConnect client is shown as it reconnects to the ASA.

This syslog is seen on the ASA:

Problem Description

These Diagnostics and Reporting Tool (DART) logs are seen with this issue:

Cisco Anyconnect Windows 10

Causes

The cause of this issue is the failure to build a Datagram Transport Layer Security (DTLS) tunnel. This could be because of two reasons:

  • DTLS is blocked somewhere in the path

  • Use of a non-default DTLS port

DTLS is Blocked Somewhere in the Path

As of ASA Release 9.x and AnyConnect Release 3.x, an optimization has been introduced in the form of distinct Maximum Transition Units (MTUs) that are negotiated for TLS/DTLS between the client/ASA. Previously, the client derived a rough estimate MTU which covered both TLS/DTLS and was obviously less than optimal. Now, the ASA computes the encapsulation overhead for both TLS/DTLS and derives the MTU values accordingly.


As long as DTLS is enabled, the client applies the DTLS MTU (in this case 1418) on the VPN adapter (which is enabled before the DTLS tunnel is established and is needed for routes/filters enforcement), to ensure optimum performance. If the DTLS tunnel cannot be established or it is dropped at some point, the client fails over to TLS and adjusts the MTU on the virtual adapter (VA) to the TLS MTU value (this requires a session level reconnect).

Resolution

In order to eliminate this visible transition of DTLS > TLS, the administrator can configure a separate tunnel group for TLS only access for users that have trouble with the establishment of the DTLS tunnel (such as due to firewall restrictions).

  1. The best option is to set the AnyConnect MTU value to be lower than the TLS MTU, which is then negotiated.

    This makes TLS and DTLS MTU values equal. Reconnections are not seen in this case.

  2. The second option is to allow fragmentation.

    With fragmentation, large packets (whose size exceeds the MTU value) can be fragmented and sent through the TLS tunnel.

  3. The third option is to set the Maximum Segment Size (MSS) to 1460 as follows:

    In this case, the TLS MTU will be 1427 (RC4/SHA1) which is larger than the DTLS MTU 1418 (AES/SHA1/LZS). This should resolve the issue with TCP from the ASA to the AnyConnect client (thanks to MSS), but large UDP traffic from the ASA to the AnyConnect client might suffer from this as it will be dropped by the AnyConnect client due to the lower AnyConnect client MTU 1418. If sysopt conn tcpmss is modified, it might affect other features such as LAN-to-LAN (L2L) IPSec VPN tunnels.

Use of a Non-default DTLS Port

Another potential cause for the DTLS failure is enabling DTLS on a non-default port after the WebVPN is enabled (for example, when the webvpn enable outside command is entered). This is due to Cisco bug ID CSCuh61321 and has been seen in Release 9.x where the ASA pushes the non-default port to the client, but continues to listen to the default port. Consequently, the DTLS is not built and AnyConnect reconnects.

After the TLS tunnel is established, the client attempts to establish the DTLS tunnel to port 444 as expected :

The order of the commands that lead to the problem and the accelerated security path (ASP) table sockets opened is:

  1. Start with the WebVPN sockets not enabled.

  2. Change TLS port to 444 and enable WebVPN.

  3. Change the DTLS port to 444.

3.1

Note: The DTLS socket port is still 443. At this point the AnyConnect clients establish DTLS to 444 though!

Resolution

The workaround for this problem is to follow the order of :

  1. Disable the WebVPN.

  2. Enter the DTLS port.

  3. Enable the WebVPN.

This behaviour does not exist in Release 8.4.x versions, where the DTLS sockets get updated with the configured ports immediately after the configuration is entered:

ASA Release 8.4.6 :

Reconnect Workflow

Suppose that these ciphers are configured:

This sequence of events takes place in this case:

  • AnyConnect establishes a parent tunnel and a TLS data tunnel with RC4-SHA as the SSL encryption.
  • DTLS is blocked in the path and a DTLS tunnel cannot be established.
  • ASA announces parameters to AnyConnect, which includes TLS and DTLS MTU values, which are two separate values.
  • DTLS MTU is 1418 by default.
  • TLS MTU is calculated from the sysopt conn tcpmss value (default is 1380). This is how the TLS MTU is derived (as seen from the debug webvpn anyconnect output):
  • AnyConnect brings the VPN adapter up and assigns DTLS MTU to it in anticipation that it will be able to connect via DTLS.
  • The AnyConnect client is now connected and the user goes to a particular website.
  • The browser sends TCP SYN and sets MSS = 1418-40 = 1378 in it.
  • The HTTP-server on the inside of the ASA sends packets of size 1418.
  • The ASA cannot put them into the tunnel and cannot fragment them as they have Don't Fragment (DF) bit set.
  • ASA printsand drops packets with mp-svc-no-fragment-ASP drop reason.
  • At the same time the ASA sends ICMP Destination Unreachable, Fragmentation Needed to the sender:
  • If Internet Control Message Protocol (ICMP) is allowed, then the sender retransmits dropped packets and everything starts to work. If ICMP is blocked, then traffic is blackholed on the ASA.
  • After several retransmits it understands that the DTLS tunnel cannot be established and it needs to reassign a new MTU value to the VPN adapter.
  • The purpose of this reconnect is to assign a new MTU.

For more information on reconnect behavior and timers, see AnyConnect FAQ: Tunnels, Reconnect Behavior, and the Inactivity Timer

Caveats

Cisco Anyconnect 4.3 Download

Cisco bug ID CSCuh61321 AC 3.1:ASA incorrectly handles alternate DTLS port,causes reconnect

Related Information

This article refers to the Cisco AnyConnect VPN. If you're looking for information on the Prisma Access VPN Beta that uses the GobalConnect app, see: Prisma Access VPN Landing Page.
If you're not sure which service you're using, see: How do I know if I'm using the Cisco AnyConnect VPN or the Prisma Access VPN?

On this page:

Cisco Anyconnect 3.1.14018

Primer

This guide will assist with the installation of the Cisco AnyConnect VPN client for Windows (Vista, 7, 8.1 and 10).

Installation

Cisco Anyconnect 3.1 Download

You need administrator level account access to install this software. When prompted with Windows UAC (User Access Control) you need to allow to install this software.

Cisco Anyconnect 3.1 Download For Windows 10

  1. Download the VPN installer from MIT's download page, Cisco AnyConnect VPN Client for Windows. Note:MIT certificates required.
  2. Find and double click the downloaded file named 'anyconnect-win-4.5.XXXXXX.exe', where XXXXXX is the sub-version number of the installer.
  3. On the following screen titled 'Welcome to the Cisco AnyConnect Secure Mobility Client Setup Wizard', click Next.
  4. When presented with the software license agreement, click I accept on the slide-down menu and click Next.
  5. Click Install when prompted (Note: the user must be an administrator of the machine to install).
    Note: You may be warned the program comes from an unknown publisher and asked to confirm that you want to allow it to make changes to your computer. Click Yes to continue.
  6. When installer begins installation you will see
  7. Click Finish when prompted to complete installation.

    Connect

  8. Launch Cisco AnyConnect.
  9. Enter the address of the MIT Cisco VPN:
    • Duo (two-factor authentication) required users must use: vpn.mit.edu/duo.
    • Non-Duo (single-factor authentication): vpn.mit.edu
  10. Click Connect.
  11. When prompted, enter your MIT username and password.
  12. For Duo users, in the field labeled 'Second Password' you can enter one of the following options:
    1. push - Duo will send a push notification to your registered cell phone with the Duo Security mobile app installed
    2. push2 - Duo will send a push notification to your _second registered device with the Duo Security mobile app installed_
    3. sms - Duo will send anSMSto your registered cell phone; then enter that as your second password (you will fill out the login info twice with this method, first to get the sms code, then to enter it)
    4. phone - Duo will call your registered cell phone
    5. phone2 - Duo will call your second registered cell phone
    6. The one time code generated by your hardware token or the Duo Security mobile app (the code changes ever 60 seconds)
      In this example, we've entered 'push' in the 'Second Password' field.
      Sometimes methods with lag time, like Call, will time out before allowing you to complete Duo Authentication. SMS and one time codes generated by your hardware token (yubikey) or the Duo Security mobile app are the fastest methods and can help you avoid time-out issues.
      'How to call different devices'
      If you have multiple devices that can use the same method, for instance two mobile phones or two phones that can receive phone calls, you can reference them by different numbers. For instance, to call the top device on your managed devices page (http://duo.mit.edu), you can use 'phone' (for the default) or 'phone1' to call the second phone, you can use 'phone2'.


  13. In this example, you will receive a push notification on your cell phone. Click Approve.
  14. Cisco AnyConnect should now present you with the MIT VPN banner and the VPN connection will complete.

See Also