Anyconnect 4.7 management tunnel vpn issue?

[osiega001]

Got the certificate connection working. Tunnel is connected but drops immediately with this message.

__________________________________________________________________________________

Function: CCvcConfig::validateMgmtTunParameters
File: vpnconfig.cpp
Line: 3641
Block-all IPv6 is not supported for management tunnel

\Function: CCvcConfig::setConfig
File: vpnconfig.cpp
Line: 1736
Invoked Function: CCvcConfig::validateMgmtTunParameters
Return Code: -33095617 (0xFE07003F)
Description: CVCCONFIG_ERROR_INVALID_MGMT_TUN_CONFIG

Termination reason code 1:
Configuration received from secure gateway was invalid.

__________________________________________________________________________________

Checking my asa config and can't see things that could be related.

What to check?

[Rob Ingram]

Hi,

The AC 4.7 management tunnel requires a machine certificate, is that the certificate you have or were you referring to a user certificate?

[osiega001]

I'm using machine certs.
Anyconnect log says it found 1 valid cert and using it.

[Rob Ingram]

Have you created a Tunnel Group and Profile for the Management Tunnel?

More information here from page 125

[osiega001]

Yes, this is how i got started :)
I simply cannot find anything that is ipv6 related / blocked in the tunnel group/ profile

[osiega001 · Accepted solution]

Finally got it working!

Was required. Probably because im not doing anything with IPv6.

(also in the manual on page 126, last lines)

[ucsbhien]

Thank you osiega001.  We were having the same issue with FTD 7.0, and we couldn't figure out for weeks.  Cisco TAC pointed out there is a bug with the management tunnel not working with IPv6 disabled.  After searching the Internet and seeing your resolution, I enabled the "Client Bypass Protocol" in the management tunnel group policy.   The management tunnel is magically connected now! 

[Barrett Cowan]

I'm not sure what exactly you're trying to accomplish, but check out my guide. A lot of good info there. You may be interested in how the Client Bypass Protocol setting works.

https://technook.home.blog/2019/07/11/cisco-anyconnect-managent-vpn-tunnel-microsoft-ca/