AnyConnect hangs waiting for network connectivity after sleep

[agerstla]

I have a persistent issue with AnyConnect on my Windows 10 laptop ever since I started keeping my VPN connection on all the time.

I put the laptop to sleep in the evening with AnyConnected connected to my VPN. But when I wake up the laptop from sleep in the morning, AnyConnect just sits there spinning with "Reconnecting, waiting for network connectivity" even though the network connection is there, active and working. 

This only happens when I am at home connected to my USB-C dock, i.e. using a wired Ethernet connection provided via the dock's external USB-C adapter (not using the laptop's internal Wifi or Ethernet adapter, which are both enabled but in "disconnected" state).

I already checked the logs (DART) and saw that the laptop disconnects from the network sometime after going to sleep, which AnyConnect recognizes and then goes into the "Reconnecting, waiting for ..." state. In the morning, AnyConnect also recognizes that the laptop woke up from sleep (log shows an "Received "exit connected standby" notice" event), but that doesn't seem to trigger a re-checking of the network connectivity state when it comes to the external USB adapter. I can trigger such a check and get AnyConnect to reconnect by making any unrelated change to the network configuration, e.g. turning Bluetooth off and on.

My Windows 10 laptop uses modern sleep. And I am on AnyConnect 4.10.06079.

[Marius Gunnerud]

I have previously had this issue also, but was unable to find a solution that allowed my PC to connect when waking up from sleep.  What I ended up doing was preventing my PC from going to sleep and just set a screen lock after X minutes.

Another possibility would be to edit the AnyConnect client profile, if your company is using this, and disable the "reconnect on wake" option.  This will require you to reconnect manually to VPN when you wake the PC.

[agerstla]

Ok, thanks, so this looks like truly a bug in AnyConnect then. 

I already have the laptop set to never go to sleep when connected to AC power (which it is when on the dock), but I guess it still does when closing the lid. And re-connecting manually is what I already have to do now. 

[Marius Gunnerud]

You should be able to change the behavior when the lid is closed so the PC doesn't go to sleep.  But other than that there is no other way that I know of at least.

[agerstla]

Well, Cisco can fix the bug to make this work as it should (and we can file a bug report as such?). 

[Marius Gunnerud]

Well, you can open a TAC case for this and have them look at it and perhaps they will file a bug report for it.  But I have a feeling that this doesn't have anything to do with AnyConnect client but rather how the windows machine behaves when it "wakes" from sleep. 

If you do open a case, let me know what they find out. 

[stsargen]

Have you tried setting the VPN profile option called " Suspend AnyConnect during Connected Standby"?  It is located on the "Preferences (Part 1)" page.

[agerstla]

Hi @stsargen, I don't have that option in my preferences:

If you are talking about the profile set by the server side, that is defined by my organization, i.e. I can't edit that, can I? And besides, as long as there is a network connection, the VPN should remain active (even in standby) or else connections will be broken/not accessible?

[Marius Gunnerud]

He is refering to the AnyConnect client profile, which I also referred to in my first post, which can be found at C:\Users\<username>\AppData\Local\Cisco\Cisco AnyConnect Secure Mobility Client

You need admin privileges to your PC to be able to edit it, but a better solution would be to edit this setting in the actual profile on the VPN headend / Firewall.

<SuspendOnConnectedStandby>true</SuspendOnConnectedStandby> <-- Set this setting to true to test

I have played around with this setting, but for me I did not get it to work with it enabled. The only option I found to work was to disconnect from VPN when suspended.  I my case we were using always on VPN so the VPN connected automatically when after disconnecting and then waking the PC.

[agerstla]

Thanks. I tried adding the SuspendOnConnectedStandby setting to my local preferences.xml now (there was no such entry before in there). But didn't help. Nothing changed, i.e. same waiting for reconnection this morning again.  

[Marius Gunnerud]

it is not in the local preferences .xml file it will have a different name...such as AnyConnect_MYCORP_SSO.xml

[agerstla]

This is the only XML file under C:\Users\<username>\AppData\Local\Cisco\Cisco AnyConnect Secure Mobility Client. There is a "EBWebView" folder next to the preferences.xml, but that folder does not contain any XML files in the hierarchy. 

[stsargen]

The XML profile will be in the C:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client\Profile\ directory

[agerstla]

Ok, thanks, found the file and setting. I changed it, but it seems to get reset when I connect to my organization's VPN. 

[stsargen]

Yes, The file will be compared to what is deployed by your headend and overwritten if needed.  I suggest that you reach out to your IT department and see if this is something they can change.  I suspect others in your organization may be having the same isse.