AnyConnect VPN Client Connected but stops passing traffic

[Legusol]

We have several users who connect to our network using Anyconnect. Their laptops connect without issue and I can see an established connection. We tunnel all traffic and everything and after a few minutes all traffic stops passing across the VPN however we can see the established session in ASDM. If we force log out the session from the ASA, the client automatically reconnects and will be fine passing traffic for a short while before it stops passing traffic again. We have about 15 users and only 3 or 4 are affected by this issue. We are running AnyConnect 4.8.03052 on Windows 10 for all 15 or so users connecting remotely. We tried AC 4.9.00096  but that did not help so we rolled back to 4.8.03052. Has anyone seen this before or know how we can resolve the issue?

[marce1000]

  - Open your VPN connection properties 'Cisco AnyConnect Secure Mobility Client Connection' and uncheck 'Connectify LightWeight Filter' (see attach for example)

 M.

[Legusol]

Thank you for the reply. I just got back in the office today. I checked out one of our user's devices having issues and she did not have the 'Connectify LightWeight Filter', however, the device did have 'Npcap Packet Driver (NPCAP)'. I have previously read that this software could cause issues and though I didn't see it installed on the system, this device must have another app that installed this driver. I have disabled this in the AnyConnect adapter properties and I have the user testing to let me know if this resolves the issue. I will follow up after a day or so as this doesn't affect the user consistently. Sometimes they can go hours without an issue and other times it is 10-20 minutes (if they are lucky!). 

[rcorchoc]

Hi Legusol, This change works?

[Legusol · Accepted solution]

I actually figured out the real issue to this. The Network Threat Detection feature of the ASA was "shunning" our VPN clients at times which was causing the period disconnect and then no network traffic to pass. Once we added the VPN IP Dhcp pool to the trusted hosts to not shun, we have not seen this issue.