At this point, I recommend contacting Cisco support about this issue. Our contact at Cisco has also told us that if we can provide a DART log bundle, they can look into the issue. If you would rather try that, please call PhoneFactor's main line at...
Cisco has told us (PhoneFactor) that some fixes for the authentication timeout went into v3.0.4 of the AnyConnect client. I recommend upgrading to that version to see if that works for the Mac clients.
I have heard from a couple of PhoneFactor customers that there is an issue in the Mac client that causes it to ignore the configured timeout if it is set to anything higher than 30 seconds. Try setting the authentication timeout in the AnyConnect pr...
If any of your users are using the Apple iOS AnyConnect client, they will need v2.5 of the client. That client was just recently released and older versions of the client have the hard-coded 12-second timeout.
The clients experiencing the issue are obviously ignoring or not understanding the timeout set in the AnyConnect profile, and therefore timeout before PhoneFactor even responds to the ASA. PhoneFactor completes the authentication and sends a RADIUS ...