Anyconnect NAM network repair from CLI

[giovanni.augusto]

Hi Everyone,

Is there a chance to execute "network repair" function for Anyconnect NAM from command line in Windows?

I am asking because it can happen sometimes via updates that the anyconnect service is disabled and to proceed on the wireless service recovery is necessary to

1) "network repair" via the tray gui

2) Reboot the workstation

Now I would like to automate this in the service recovery options of windows to have a service recovery option (3rd option) to run a script to run network repair and then reboot the workstation autonomously

Thank you

[Ben Walters]

As far as I know it is not possible to call the network repair function from AnyConnect from CMD but I believe you could replicate the functionality with a script.  

You would just need a script that, stops and restarts the AnyConnect services and disables and enables the wireless network adapter.

[stsargen]

This is possible using the "acnamcontrol.exe" option from the commnad line.  The tool is located in C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\acnamcontrol.exe.  Two options exist with this tool.  "restartAdapter" and "enable"/"Disable" Client.

C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client>acnamcontrol.exe
Usage: acnamcontrol.exe restartAdapter <adapter_symbolic_name_list>

Description: Restarts the network adapters.

Usage: acnamcontrol.exe [enableClient|disableClient]
Description: Enables/Disables NAM functionality.

[giovanni.augusto]

Thank you very much,

Is there a way to reset all network interfaces without knowing the GUID? or how to easily find the GUID for the network interface used on a workstation?

Thanks!

acnamcontrol.exe restartadapter
Usage: acnamcontrol.exe restartAdapter <adapter_symbolic_name_list>
Restarts the network adapter(s) listed.
The adapter symbolic name in Windows is a GUID.
One or more adapters can be listed. If space is used
for a separator, the list should be enclosed in
quote marks.

[stsargen]

You can use Powershell or Netsh to get the adapter GUID and add this to whatever script youwill be running.

Netsh command:

netsh wlan show interfaces

netsh lan show interfaces

or with Powershell using Get-NetAdapter.  I am not sure of th eSyntax but I am sure you can find it online.

https://docs.microsoft.com/en-us/powershell/module/netadapter/get-netadapter?view=win10-ps

[patrickmcinerney]

Came across the need for this too when users face the following error:

Authentication failed due to problem navigating to the single sign-on URL

So I thought I'd share a solution

<#

# Get all network adapters with status "Up"
$upAdapters = Get-NetAdapter | Where-Object { $_.Status -eq 'Up' }

if ($upAdapters.Count -gt 0) {
# Sort adapters by index number to get the primary one
$primaryAdapter = $upAdapters | Sort-Object Index | Select-Object -First 1
}

# Get adapter details
$InterfaceGuid = $primaryAdapter.InterfaceGuid

# Create arguments list
$namarguments = "restartadapter $InterfaceGuid"

# Run network repair
Start-Process -FilePath "C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\acnamcontrol.exe" -ArgumentList $namarguments -Wait -WindowStyle Hidden -Verb RunAs

#>

[alisha_rascon01]

As of my last knowledge update in January 2022, Cisco AnyConnect Network Access Manager (NAM) primarily offers a GUI-based interface, and there might not be a built-in command-line option specifically for "network repair."

However, you can create a workaround using command-line tools or scripting to achieve a similar result. Here's a basic outline of how you might approach this:

1. Network Repair Script:

Create a script (e.g., a PowerShell or Batch script) that mimics the actions performed during a network repair. This may include stopping and restarting services, resetting network configurations, etc.

2. Service Recovery:

Set up a Windows service recovery option to run your script. You can do this using the sc command or using the Services GUI.

For example, you can use the sc command like this in an elevated Command Prompt or within your script:

sc failure "YourServiceName" reset= 86400 actions= restart/60000/run/your_script.bat

In this example, 86400 is the reset time in seconds (24 hours), 60000 is the delay before the first action (60 seconds), and your_script.bat is the script you created.

3. Reboot Option:

You can include a reboot command at the end of your script or set it as a separate action in the service recovery options.

shutdown /r /t 0

This command will initiate an immediate restart.

Please note that the exact steps and commands may vary depending on your specific environment and requirements. Additionally, it's essential to test the script and service recovery options in a controlled environment to ensure they work as expected.