I have a group of users that use Windows 10 machines with a built in 4G adapter.  These uesrs would have issues where the VPN would disconnect and reconnect and just have issues. Laptops loose internet connectivity and have to reboot.  We are doing Full Tunnel on the anyconnect.   The computers connect to 4G successfully. Problems arise only after connecting to VPN. Symptoms are constant connect/disconnect loop.  This also, sometimes, causes 4G to disconnect completely, leaving the trooper without any connection at all. We moved to Split tunnel to accommodate more users and these issues cleared up for these issues.  We are not why though. ... View more

I have 2 stacks of 3850s running 3.6.8E, they were 3.6.6E.  all of our 802.1x clients are failing in ISE.  Our MAB devices are authenticating in ISE  We have other 3.6.8E switches that are authenticating just fine 802.1x and MAB on the same network.  I can move a device that is failing to a different switch and it authenticates just fine.   Interface MAC Address Method Domain Status Fg Session ID Gi4/0/24 00ca.e540.3b1d N/A UNKNOWN Unauth 0A00011E00001273003E36F4 Gi2/0/44 ecb1.d737.a01c N/A DATA Unauth 0A00011E0000121C003E0F08 Gi2/0/48 5065.f344.56b7 N/A DATA Unauth 0A00011E00001281003E5792 Gi4/0/17 a08c.fdc9.7a36 N/A DATA Unauth 0A00011E00001206003E0C42     policy-map type control subscriber ISE-PMAP-522 event session-started match-all 10 class always do-until-failure 10 authenticate using dot1x retries 2 retry-time 0 priority 10 event authentication-failure match-first 10 class AAA_SVR_DOWN_UNAUTHD_HOST do-until-failure 10 activate service-template CRITICAL_AUTH_VLAN_522 20 activate service-template DEFAULT_CRITICAL_VOICE_TEMPLATE 30 authorize 40 pause reauthentication 50 clear-authenticated-data-hosts-on-port 20 class AAA_SVR_DOWN_AUTHD_HOST do-until-failure 10 pause reauthentication 20 authorize 30 class DOT1X_NO_RESP do-until-failure 10 terminate dot1x 20 authenticate using mab priority 20 40 class MAB_FAILED do-until-failure 10 terminate mab 20 authentication-restart 60 50 class DOT1X_FAILED do-until-failure 10 terminate dot1x 20 authenticate using mab priority 20 60 class always do-until-failure 10 terminate dot1x 20 terminate mab 30 authentication-restart 60 event agent-found match-all 10 class always do-until-failure 10 terminate mab 20 authenticate using dot1x retries 2 retry-time 0 priority 10 event aaa-available match-all 10 class IN_CRITICAL_VLAN do-until-failure 10 clear-session 20 class NOT_IN_CRITICAL_VLAN do-until-failure 10 resume reauthentication event violation match-all 10 class always do-until-failure 10 restrict     interface GigabitEthernet2/0/22 switchport access vlan 3216 switchport mode access switchport voice vlan 2123 authentication periodic authentication timer reauthenticate server access-session port-control auto mab dot1x pae authenticator dot1x timeout tx-period 10 no cdp enable spanning-tree portfast service-policy type control subscriber ISE-PMAP-3216     We have Cisco IP phones with certs along with PC with Certs. We are using new style and I have compared all the aaa settings and policy maps.  I am starting to draw blanks on what to look at next.   Any help would be insightful. ... View more

I have a handful of users in the same Active Directory group that has disconnect and reconnect issues.  They will connect then anyconnect will disconnect and reconnect them, usually 3 times in a row before it settles down.  This issue has not been reported among the 400 or so other users.  I am posting a picture of the users anyconnect history.   We are using Anyconnect 4.6.01103, on the log from the ASA I do not see this disconnect or reconnect.   ... View more

We had a few users complain about disconnects and reconnects.  We have on average about 500 people who connect to the anyconnect on our ASA 5555.   While looking for a reason we discovered that the Outside interface has some errors and overruns on it.  We do not have flow control turned on.  Could this be a reason why we might have a few users showing disconnects and reconnects?     Interface GigabitEthernet0/0 "", is up, line protocol is up Hardware is i82574L rev00, BW 1000 Mbps, DLY 10 usec Auto-Duplex(Full-duplex), Auto-Speed(1000 Mbps) Input flow control is unsupported, output flow control is off Description: External Client Data Active member of Port-channel1 MAC address cc46.d6f8.4c39, MTU 1500 IP address unassigned 305036353232 packets input, 200800159375818 bytes, 0 no buffer Received 540722 broadcasts, 0 runts, 0 giants 38028648 input errors, 1 CRC, 0 frame, 38028647 overrun, 0 ignored, 0 abort 0 pause input, 0 resume input 0 L2 decode drops 146520215511 packets output, 99195296755085 bytes, 0 underruns 0 pause output, 0 resume output 0 output errors, 0 collisions, 0 interface resets 0 late collisions, 0 deferred 0 input reset drops, 0 output reset drops input queue (blocks free curr/low): hardware (491/321) output queue (blocks free curr/low): hardware (511/0) ... View more

I have users that connect with anyconnect and then use IBM iBase to connect to a database.  When the users connect to anyconnect and then to iBase the users are disconnected from anyconnect and then they reconnect.  This disconnects and reconnects happen 3 times.  Then anyconnect seems to settle down.  We have multiple users that do not use iBase that do not have this issue.  So far this seems to be isolated to just the users that use iBase.  We are using anyconnect 4.6.01103.  I am not sure about the iBase software, I am still waiting on a reply with their version of the software they are using. ... View more

We are testing out using machine certs to authenticate anyconnect VPNs, Does anyone have templates for the asa and pc certificates?  And maybe some best practices for setting up the connection profile? ... View more