cscan 4.10.5095.0 crashes

[rdunnill]

Two days ago, after several months of trouble-free operation, my AnyConnect installation refused to connect to the corporate VPN from my home network unless I first connected through a network other than my home network, such as Starbucks WiFi. After connecting through Starbucks, I could connect once and only once through my home network. If I disconnect, I cannot connect again through the home network unless I first connect through a different network.

The symptom is that the Mobility Client dialog hangs with a 'Please complete the authentication process in the AnyConnect Login Window." message.

It appears that the reason for the hang is that after the Single Sign-on authentication is entered, cscan.exe crashes with an access violation in libwalocal.dll.

Can anyone shed light on what might be the cause? 

Machine is a Dell Precision 7550 and OS is Windows 10 build 21H2 Build 19044.1645.

[YasirHaidri]

Faulting application name: cscan.exe, version: 4.10.5111.0, time stamp: 0x629923fd
Faulting module name: libwalocal.dll_unloaded, version: 2022.5.10.2, time stamp: 0x627a105f
Exception code: 0xc0000005
Fault offset: 0x00069e72
Faulting process id: 0x1710
Faulting application start time: 0x01d897759096003d
Faulting application path: C:\Program Files (x86)\Cisco\Cisco HostScan\bin\cscan.exe
Faulting module path: libwalocal.dll
Report Id: 36b34093-2166-42ce-8f30-32b777f458d6
Faulting package full name:
Faulting package-relative application ID:

[YasirHaidri]

issue resolved after uninstalling the router update. 
some users were able to connect using their mobile hotspot and then change to home wifi. issue was intermittent and definately it was related to last router update

[rdunnill]

My experience was similar: I could connect at a local Starbucks WiFi, and then come home and connect exactly once.

[mxl_vt]

We have also run into this exact issue. It started occurring since AnyConnect/HostScan version 4.10.05085 and up, with both Windows 10 and 11, and it is intermittent. I saw this fix about about a RestoreConnection registry entry from the link below, so it may be worth trying.

https://community.cisco.com/t5/network-access-control/anyconnect-posture-scan-stuck-at-10-for-a-long-time/td-p/4275315

[crgood]

Hi, Did the RestoreConnect registry entry information resolve your issue?

[rdunnill]

No. I had to wait until the server was updated.

[crgood]

I have a few questions if you have time.

You updated hostscan or the AnyConnect Client?

Did you find out if this was related to any bugs?

Which versions did you update to for resolution?

Thanks so much for the prompt response! I was informed there are a small number of people running into this problem. I think I am chasing a red herring at the moment because I noticed symantec AV scan and the cscan.exe application crash happening at the same time on one users system. Also did you notice if Macs were having an issue with this or only Windows?

[rdunnill]

I believe the problem stemmed from the server hostscan and was unrelated to the client applications. Neither updating the AnyConnect client multiple times nor tweaking Registry entries resolved the crashes. 

The AnyConnect client software crashed on this error, indicating a defect, but whether Cisco intends to fix the defect I don't know.

Be aware, though, that this error was significant enough that our IS group pushed Cisco to determine the problem and effect a workaround. The back and forth continued for weeks or even months. 

[crgood]

Thanks again for the feedback. I will be playing the same game with TAC. I can't believe more people haven't reported this issue its very intermittent but widespread. Our sysadmin teams have also gone through the uninstall/reinstall AnyConnect, OS rebuild, deleting the hostscan files, certs and etc...the usual stuff on the local user systems. We have had to downgrade in the past I truly hope that isn't the only answer at this point.

[mxl_vt]

No, the RestoreConnect did not fix the issue. We opened a case with TAC, and the workaround was to downgrade the HostScan to version 4.10.03104 (not necessary to downgrade the AnyConnect clients on the users' computers or the webdeploy packages on the ASA).

[crgood]

Thanks, we did that before. I have a TAC case open, hopefully some additional pressure to truly resolve will help us all. Thank you for the feedback on the workaround that was provided.

[rdunnill]

Yes, that's the solution I was told our IS group used.

And in my case, this problem was not intermittent: I was permanently barred from connecting at all.

[crgood]

Thanks everyone for your input. I have a TAC case in and will let you know if there is any new answers to actually fix the problem.

[mxl_vt]

By the way, it seems like the new HostScan 4.10.06081 has resolved a Libwalocal.dll crash. Let us know if anyone had a chance to test this version (or any of the newer 5.x versions). Thanks.