Anyconnect cannot connect VPN when unrelated Smartcard is inserted.

[Bernhard Ertl]

Hi Community.

We are cureently facing the issue that AnyConnect 4.6.00362 won't connect to VPN when an unrelated smartcard is inserted in the windows pc.

anyconnect uses machine certificates as an additional means of authorization but it should not check the userspace for any certificates like smartcard.

When SC is removed VPN connect works without delay or issues.

does anyone have an idea where to look at?

regards

Bernhard

[Marvin Rhoads]

The default behavior is to check for user certificates. You can override that in the VPN profile by choosing the Machine certificate store and checking the "Certificate Store Override" box.

[Bernhard Ertl]

Hi Marvin,

thanks for your reply.

The thing is that the profile is already set to Machine store.

Here is the screenshot of it.

as far as I can trust the user, he's got a 10% chance of it working despite the smart card inserted.

if it's not working the removal of the sc will solve the issue.

still Windows 7 it it helps.

[Marvin Rhoads]

I haven't seen the problem myself but there are a couple of thread reporting similar behavior when the ASA certificate doesn't have a SAN matching the FQDN in the profile's server list.

https://community.cisco.com/t5/vpn-and-anyconnect/solved-anyconnect-fails-to-use-machine-certificate-for/td-p/2953035

https://community.cisco.com/t5/vpn-and-anyconnect/authenticating-anyconnect-vpn-client-using-certificates/td-p/1573107

https://community.cisco.com/t5/vpn-and-anyconnect/machine-certificate-authenticaton-requires-anyconnect-to-quot/td-p/2720156

[Bernhard Ertl]

good idea,
will check and report back

thanks

[Bernhard Ertl · Accepted solution]

The solution for me was to upgrade the users in question to W10 and use AnyConnect 4.8.

The issue was never to be seen again.