Hi Yvon, Does disabling the KB fix resolve the problem even with ASA 8.4.3.9 ? without looking at the ssl stream with private key exported and the ASA debugs/logs, its hard to say its a new issues. It would be best to open a TAC case so that this can be further analyzed and new bug opened if this is a new defect. Tom ... View more

Hi Michael, unfortunately on IOS, the defect is not resolved yet, so only the workarounds will work. ... View more

on ASA for the majority, there are no issues, but some isolate incidents have been seen. This tracked using the defect: http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCtx68075 Are you seeing any issues with ASA ? ... View more

Hi Michael, The problem is with IOS and there is a defect filed against IOS for that: http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCtx38806 The bug id is CSCtx38806 Any of the following workarounds will work: 1)Use the clientless portal to start the client- this only works in some versions of IOS. 2)Uninstall the update 3) Use rc4 - is a less secure encryption option, if this meets your security needs, then you may use it as following: webvpn gateway    ssl encryption rc4-md5 4) use AC 2.5.3046 or 3.0.3054 for anyconnect For anyconnect users, the user error message is : "Connection attempt has failed due to server communication errors. Please retry the connection" The anyconnect event log will show the following error message snippet: Function: ConnectIfc::connect Invoked Function: ConnectIfc::handleRedirects Description: CONNECTIFC_ERROR_HTTP_MAX_REDIRS_EXCEEDED ... View more

No, the data port is fully isolated from the phone VPN session, just like without VPN. ... View more

Hi, The feature you are talking about is purely IPSEC : ipv6 for ikev1 and ikev2 . Ipsec for ipv6 with ike v1 is supported on the ISR G1 platforms. Its only that ike v2 is only supported on ISR G2 platforms. Hope that helps... ... View more

Hi, IKE V2 is not supported on ISR G1 platforms (28xx 18xx series router) and  supported on the ISR G2 platforms which are 19xx and the 29xx platforms. Hope that helps. ... View more

hi, I suspect this could be a DNS issue, are there multiple DNS suffixes defined ? Do you experience the same problem when using a ip address instead of a DNS name ? Once the first page is loaded do further pages load fine without delay ? I would also suggest getting a packet capture, so that you can see where is the  initial delay : https://supportforums.cisco.com/docs/DOC-1222 ... View more

Hi, You need TCP port 443 for TLS and UDP port for DTLS (when you using anyconnect) ... View more

Hi, Hostscan does not require radius. Based on your DAP configuration, it looks like the default DAP policy action is set to continue. If you have a specifc DAP policy (new one you created) set to continue, then the default should be set to terminate such that when it does not match that record, it will match again default and it will be set to terminate. You can verify which dap record its matching by running the following debug: debug dap trace debug dap error This will show you what hostscan results are retrieved from the machine scan and what DAP record is matched. Please check the following article for more details: https://supportforums.cisco.com/docs/DOC-1369#Configuring_Dynamic_Access_Policies ... View more

Marc, Yes, DTLS is very important to get maximum throughput as its based on UDP and connectionless... Glad to hear its working better now... ... View more

Hi, Do you mean that you are trying to use SSLVPN (anyconnect) and PPTP at the same time ? If yes, then its not supported. ... View more

Hi Marc, You can get performance in excess of 2 Mbps, but there are many factors that come into play: 1) ISP bandwidth 2) latency / RTT (round trip time) 3) PC horse power 4) network conditions like packet loss, congestion etc 5) whether DTLS is used or TLS used with anyconnect For example on a FIOS, customers have been able to get over 15 Mbps using DTLS using a very good RTT. On a local LAN, you can get much more throughput, so some of the above mentioned are the limiting factors. Hope that helps. ... View more

Hi, have you looked at the java plugins: http://www.cisco.com/en/US/docs/security/asa/asa80/configuration/guide/webvpn.html#wp1292779 We also have a option for thick client using smart tunnel: http://www.cisco.com/en/US/docs/security/asa/asa80/configuration/guide/webvpn.html#wp1218044 What application will be used here ? I am afraid those are the two other options in addition to what you have listed... ... View more