AnyConnect reconnect automatically to backup server when the primary fails

[ConstantNSAH8220]

Hi Team,
We have 2 ISP with our Firepower and we are looking into redundancy for our AnyConnect VPN and we found the Backup Server.
Our request:
We just want AnyConnect to automatically reconnect to the Backup Server in the list when a remote anyconnect user loses connectivity on the primary connection.
Currently, AnyConnect is getting stuck and he is trying to reconnect to the primary, rather than going to the next backup server.

The workaround:
It works if the user manually disconnect the connection then re reconnect, it will first try the primary then it will go to the backup and successfully connect

We are running the latest version Anyconnect 4.X

In advance, thank for your help

Regards

[ConstantNSAH8220 · Accepted solution]

Finally, I got an answers: this is documented via https://bst.cloudapps.cisco.com/bugsearch/bug/CSCut96439/?reffering_site=dumpcr

------------------------

Symptom:
AnyConnect session fails or becomes stale. The backup servers mentioned in the XML profile are not attempted for fallback connection.

Conditions:
1. AC profile has a backup server list configured
2. AC user successful connects to primary server
3. Primary server is no longer reachable, resulting in a stale connection.
4. AC should eventually try to connect to the backup server without making the user manually disconnect. Currently, the user is forced to manually retry connecting to the primary ASA, which must fail to establish before the backup server list is attempted.

Workaround:
Manually disconnect from the original failing session, then reattempt. (this is the process we need to automate)

------------------------

[havy]

Hi ConstantNSAH8220,
have you found a solution for this problem?
Regards 

[aamadulin.accenture]

Hi Cisco Folks,

Any comment on this issue, do you have permanent fix for this problem?

[tvotna]

Believe you or not, this has been discussed since 2010, ASA 8.x and AnyConnect 2.y:

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCte15271

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCte15276

The problem here is that primary firewall doesn't share session info with backup nodes, hence transparent reconnect isn't possible if AAA is used (the user would be presented with a login prompt which is undesirable). This feature could have been implemented for cert-only authentication, but this has never been done. So, client will remain in reconnecting state until either a) manual user disconnect b) max connect time c) idle time is reached. Both b) and c) are typically set high on ASA in the group-policy, so users have to disconnect and connect manually.

Same issue exists for VPN load-balancing clusters, but for load-balancing this would be easier to implement, because there is a control protocol between units. In fact, this feature was implemented in IOS / IOS-XE 15.6 for IKEv2 (with some limitations), but not on ASA:

CSCut83969 Xe317: Ikev2 cluster reconnect support