topic Re: Cisco Anyconnect time out connection on IOS only in Network Security

Cisco Anyconnect time out connection on IOS only

ladani001 — Fri, 21 Feb 2020 15:46:22 GMT

Hello everybody

I have ASA 5540 and its configured for VPN over SSL only. it has been working for 2 years smooth, but since 3 days ago something weird is happening on most of my ios clients who are using cisco anyconnect on their IPhone and IPad. they are receiving " time out error ". Androids are using openconnect , windows and mac are using cisco anyconnect and they are working fine too, its happening on most of ios users.

ping to ASA, trace route ( MTR ) are fine.

any idea ?

best Regards

Yashar

Re: Cisco Anyconnect time out connection on IOS only

Florin Barhala — Wed, 16 May 2018 09:01:52 GMT

We could bet that an IOS update hit your clients.

Any chance to test with an older IOS VPN client version?

Also you can consider updating your "VPN server" and hopefully that will match latest Apple IOS vpn client.

Re: Cisco Anyconnect time out connection on IOS only

ladani001 — Wed, 16 May 2018 09:29:46 GMT

Hello Florin

I tried Legacy anyconnect and same issue. for updating ASA needs contact and I cant download the latest version software. can you help me on IOS if you have the latest one. the one I have is ASA 5540 version 9.1(7).

Re: Cisco Anyconnect time out connection on IOS only

Florin Barhala — Wed, 16 May 2018 09:48:34 GMT

That I can't do. Let's see what other have to say about this issue though.

Re: Cisco Anyconnect time out connection on IOS only

ladani001 — Wed, 16 May 2018 10:02:33 GMT

As I have study on clients during these few days :

1- Anyconnect new version and Legacy is not working on ios only.

2- Anyconnect on windows /Mac and openconnect on android are connecting easy through the same internet that IOS cannot.

3- this problem is happening only for those who are trying to connect from IRAN.

Possibilities:

I thought maybe providers/government has restricted connection to my IP address, but if its restricted why the others are able to connect through same internet with different os; so its not possible my IP is restricted.

they filtered Anyconnect Application to make socket to outside, but why only IOS ? if there is any be restriction on application layer , it should be applied to all cisco apps.

confusing...

do you think changing SSL certs and domain name / IP block helps ?

Thank You

Yashar

Re: Cisco Anyconnect time out connection on IOS only

Marius Gunnerud — Wed, 16 May 2018 10:43:33 GMT

It is most likely as Florin has already mentioned, an iOS software update that has been released for the Apple devices. Do you have an Apple device that has not installed the latest update yet?

Re: Cisco Anyconnect time out connection on IOS only

ladani001 — Wed, 16 May 2018 12:07:39 GMT

mine is 11.3.1 and connects easy, but the difference is I am not in IRAN. as I checked with few of clients they have 11.2.1 and cant connect.these people with latest version and previous version of IOS were able to connect 4 days ago.

Re: Cisco Anyconnect time out connection on IOS only

ladani001 — Wed, 16 May 2018 15:54:16 GMT

here is error when connection doesn't establish.

Re: Cisco Anyconnect time out connection on IOS only

Florin Barhala — Thu, 17 May 2018 07:52:41 GMT

At this stage, you could also debug SSL VPN when client attempts to connect. Maybe there's an error there. Otherwise Cisco TAC should be the last line of defense.

Re: Cisco Anyconnect time out connection on IOS only

ladani001 — Thu, 17 May 2018 17:26:39 GMT

Hello

Yes, I did debug and the cert was completely current, but I found out the SSL connection/signature is resetting every 30 seconds by providers, seems they have filtered my domain name. I ordered for as a new SSL cert and domain name. Im going to swap out the cert and IP block and lets see what happens .

I will update the result here.

Thank You

Best Regards

Yashar

Re: Cisco Anyconnect time out connection on IOS only

ladani001 — Fri, 18 May 2018 03:25:39 GMT

Hello everybody,

I have changed the ASA IP and swapped out the cert, but still those who are using anyconnect on ios ( new and legacy version ) are not able to connect.
guys, is it possible Cisco Anyconnct app to be filtered from opening socket outside ?
is there any alternative app/solution ?

Re: Cisco Anyconnect time out connection on IOS only

Martin Carr — Fri, 18 May 2018 21:23:10 GMT

It seems to me the issue is Iran has blocked access to your network.

Can you check if port 443 is open and also if you can access the clientless VPN?

Martin

Re: Cisco Anyconnect time out connection on IOS only

ladani001 — Sat, 19 May 2018 11:29:43 GMT

Dear Martin

Port #443 is blocked by provider ( as I found out ) to solving this problem :

1- I have changed " IPSec Client Service Port " port from 443 to any other numbers (ex: 999)

2- in Anyconnect setting I changed server address from srv.mydomain.com to srv.mydomain.com:999

now clients passes the first step to choosing profile and entering username/password as they couldn't reach to this step before, but I Im facing with another problem :

* when client enter username/password, they receive error " login denied, unauthorized connection mechanisrm, contact your administrator "

any idea ?

Re: Cisco Anyconnect time out connection on IOS only

ladani001 — Sat, 19 May 2018 16:43:36 GMT

I debugged radius packets on Billing server and saw the ASA is sending username and password, but instead of password, username again.

totally confused, same radius setting is working fine current profile which is set with srv.mydomain.com

Re: Cisco Anyconnect time out connection on IOS only

Martin Carr — Sat, 19 May 2018 17:32:57 GMT

Thought so.

That issue you now have is it would appear the GP is not setup for the correct tunnelling protocol (i.e. SSL VPN Client) in this case.

Can you clarify?

Martin

Re: Cisco Anyconnect time out connection on IOS only

ladani001 — Sat, 19 May 2018 19:22:08 GMT

Dear Martin

I have set the GP on SSL and L2TP/IPSec tunnel only.

lets check again , maybe the way I have set port number is not correct. could you please let me know how should I set port number for authentication ( ex: srv.myvipport.com:800) ? I did on port setting ( screen shot "port-no" ) .

Re: Cisco Anyconnect time out connection on IOS only

Martin Carr — Mon, 21 May 2018 12:26:34 GMT

That port only applies to IPSEC.

I would recommend looking at the real time logs and then get someone to login, but from that error it suggests to me it's not deeming the connection to be from an SSL client.

Martin

Re: Cisco Anyconnect time out connection on IOS only

ladani001 — Mon, 21 May 2018 18:20:00 GMT

Dear Martin,

Yes, its for IPSec and because of that I have created IPSec profile and GP related to it with a tunnel type of IPSec , l2tp/IPSec.

as I monitored Radius Server ( accounting ) here is the debug log :

User-Name = "aliyashar"
User-Password = "aliyashar"
NAS-Port = 9850880
Called-Station-Id = "ASA IP"
Calling-Station-Id = "Accounting IP"
NAS-Port-Type = Virtual
Tunnel-Client-Endpoint:0 = "Accounting IP"
NAS-IP-Address = "ASA IP"
Cisco-AVPair = "ip:source-ip=Accounting "
Vendor-3076-Attr-146 = 0x6970736563
Vendor-3076-Attr-150 = 0x00000002

as you see ASA is sending password same as username.I set the password same as username and tried again,now, accounting accept the user authentication ( radius log: AuthOK), but user receives error and ASA resend request again and again to accounting.

when I set IPSec "ON" for connection in anyconnects advance setting authentication will be successful ( user/pass format will be sent correctly ). IPSec is filtered as 443 has been blocked already.

the best way to bypassing the filtering is sending authentication request from a different port as I did ( srv.mydomain.com:800 ) and with out adding port number connection to ASA goes timeout, when I add port it reaches to authentication step and choosing profile, but error in authorization mechanism .

Thank You

Re: Cisco Anyconnect time out connection on IOS only

ladani001 — Tue, 22 May 2018 19:03:50 GMT

Hello All

I have fixed the problem. I was changing the ports though the wizard and it was not working, but I went through command line, and its working now.

webvpn
no enable outside
port 800
enable outside
anyconnect enable
tunnel-group-list enable