AnyConnect Client on Windows 8.1 not connecting to ASA 5510

[CSCO10979858]

- This particular ASA (5510) is running the latest OS 9.1.6, Comodo SSL Certificate/2048bits, and Intermediate Certificates installed. 

- Clients are running the latest AnyConnect 4.1.02011.

AnyConnect works perfectly with Windows 7 and Mac OS X (Yosemite), but whenever I try to connect from a PC with Windows 8.1, I get the following error:

"Connection attempt failed. Please try again."

Does not even get to the prompt to enter the user's credentials.

*EvenViewer errors/warnings and a screenshot are attached 

[Boris Uskov]

Hello. Can you, please, try to initiate the connection by browser?

I mean, open the web-browser and enter https://vpn.******.com in address bar and press enter. This can help us to verify the network connection from the client's PC to the remote ASA. It could be a very first step of our troubleshooting.

[CSCO10979858]

Hi Boris,

That works, this is not an issue with DNS resolution, actually the authentication works on the WebVPN on all the platforms, including Windows 8.1

Remember the issue is ONLY reproducible with AnyConnect on Windows 8.1, I have tested this with multiple PCs with Windows 8.1 already.

Do you know if the ASA OS 9.1.x supports Windows 8.1, I know it sounds silly, but it id a possibility...

***With the same PCs running Windows 8.1 I am able to connect with AnyConnect to another site with an ASA 5512 which is running the OS 9.2.1.

Any thoughts?

[Boris Uskov]

Hello, 

I'm not sure, but I think that the version of ASA's software does not influence the Anyconnect operability. If the ASA's software supports Anyconnect 4.1, it should work.

I think the problem is somewhere within the compatibility of Anyconnect 4.1 and Win 8.1.

Did you try to enable compatibility mode for Anyconnect Client?

Right click vpnui.exe in the 'Cisco AnyConnect Secure Mobility Client' folder.
(C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\)
Click on the 'Run this program in compatibility mode for" 
Choose 'Windows8'
Click Apply and then OK.
Start anyconnect and click on "Connect". 

Some customers have reported that they needed to also set up compatibility mode for the
vpnagent.exe executable.

https://tools.cisco.com/bugsearch/bug/CSCus89729

[CSCO10979858]

Thanks for your prompt response Boris,

I already tried the compatibility solution with not success, I will try the other solution from the link you shared, even though it is related to another error message.

...but remember, the same PCs running Windows 8.1 are able to connect perfectly to the other site with the ASA 5512 (OS 9.2.1), so it does not seem to be a compatibility an issue with AnyConnect 4.1 and Windows 8.1

Thank you!

[Florin Barhala]

Is this happening on just one workstation or many more?

What I would do: create a new simple any connect profile on the 5510 and test if this works.

[CSCO10979858]

Hi Florin,

I have tested this on 3 physical workstations and 2 VDIs with Windows 8.1: Not working

I have tested this on 4 physical workstations with Win 7 and 1 Macbook with Yosemite: Working perfectly.

I am going to create a new profile for testing purposes, but this ASA 5510 was deployed recently on this site, meaning the profile being used at the moment is kind of new.

[CSCO10979858]

Tested the same thing with Windows 10, it worked like a charm.

After researching a little bit more, I came across with a solution from a Microsoft forums that resolved the issue on Windows 8.1 by running the following commands on the ASA 5510:

ssl server-version any

ssl client-version any

ssl encryption rc4-sha1 dhe-aes128-sha1 dhe-aes256-sha1 aes128-sha1 aes256-sha1 3des-sha1

Thank you guys for your support.

[Boris Uskov]

Hello! Great, that you have found the solution. Thanks for info!