AnyConnect - Connecting to network errors: Please enter a secure gateway to connect to

[dgaikwad]

Hello Experts,
I have configured to install AnyConnect from ISE when the user gets redirected to CPP page.
The user is able to install and get posture done via the above flow.

But, now what I have seen is that whenever user make a change of network, like disconnecting from wired to wireless, AnyConnect will popout this error: "Please enter a secure gateway to connect to"

I am not pushing any VPN profile as off now as well, this is a pretty straight forward installation and flow.

I have tested this AnyConnect version 4.7 and 4.8 as well, but the results are the same in both the cases.

Is there something that is missing out?

[Mike.Cifelli]

Can you look here to confirm that you do not have a profile on the system: C:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client\Profile\
If you do can you share the contents?

[dgaikwad]

Ok, I was able to get some information as off when that alert was popping up.
1. When AnyConnect was installed via VPN for the first time and then connecting back to wired and wireless network internally produced that alert
2. If AnyConnect was first installed from the internal network, then in that case, the alert was not generated 

Attached is the file from: C:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client\Profile\

[dgaikwad]

I was not able to attach the file so have added it here 

[dgaikwad]

This is a bit late, but did you find anything from the profile.xml that was shared a year ago?
Since another customer has started to face this issue now...

[Milos_Jovanovic]

Hi @dgaikwad,

From the pasted XML profile, I can see following section:

<AutomaticVPNPolicy>true
 <TrustedDNSDomains>*prasac.com.kh</TrustedDNSDomains>
 <TrustedDNSServers>ns1.prasac.com.kh</TrustedDNSServers>
 <TrustedNetworkPolicy>Disconnect</TrustedNetworkPolicy>
 <UntrustedNetworkPolicy>Connect</UntrustedNetworkPolicy>
 <AlwaysOn>false
 </AlwaysOn>
</AutomaticVPNPolicy>

This means that you have Trusted Network Detection configured, which will connect to VPN each time when it detects untrusted network (whenever your assigned domain is not '*prasac.com.kh' or your DNS server is not 'ns1.prasac.com.kh'). However, there is no <ServerList> section, which would contain your gateway details.

By doing this, you are asking your user to go to VPN each time he is not in office (I'm assuming), but PC has no idea where to go, reporting this error.

You need to fix this profile.

BR,

Milos

[Benjamin_Leung]

Mates, I am facing this problem, either. How did you fix it? As no matter how do I change config and I confirm it has profile in C:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client\Profile\, problem still exits

But my another PC config to the same path, which is working fine, except my MacBook VM Windows 10

SOS!