Fix for this one is to set a console timeout to a low value and then it will automatically log the session off, you can then disable the timeout again.   console timeout 2

Yes, it's a pain and so far no sign of a fix.   If you use Safenet then their client works OK for 2 factor, but for Cisco's own product not to work seems ridiculous.

7 years late but my thinking is that on the VPN head end firewall he had it configured to tunnel all traffic back and not split it out, therefore any replies to pings on the Outside interface would try to go via the tunnel.   This was a VPNClient con...