AnyConnect was not able to establish a connection to the specified secure gateway. Please try connect again and and VPN Establishement Capability from a Remote Desktop is disabled

[chetan.sharda1]

Hi All,

I am using VPN (anyconnect-win-3.0.5080) to access the client server.While  I connect the VPN from my local system, VPN connection is established  successfully.
While I connect the VPN using RDC machine (AWS/Ec2 Amazon ), VPN connection is not established successfully. I am getting the following error,

1. AnyConnect was not able to establish a connection to the specified secure gateway. Please try connect again
2. VPN Capability form a Remote Desktop is disabled. VPN connection will not be established

I have tried following soultions but none of them are working

Solution 1: Change the settings in the AnyConnectProfile.tmpl configuration  file.
Solution 2: Any connect client profile needs to be created using  ASDM.

Please help me to resolve this issue and connect the VPN from the staging  server machine using RDC.

Please let me know if you need any additional details on this.

Thanks,

[Dinesh Moudgil]

Hi Chetan,

Please configure the anyconnect profile (.xml file) to be configured for "AllowRemoteUsers" as shown in the attached snippet.
This will allow the VPN sessions to be originated from remote machines as well.

For future reference:-
http://www.cisco.com/c/en/us/td/docs/security/vpn_client/anyconnect/anyconnect30/administration/guide/anyconnectadmin30/ac13vpnxmlref.html#40060

Regards,
Dinesh Moudgil

P.S. Please rate helpful posts.

[chetan.sharda1]

Hi Dinesh,

Thanks for reply.

I have received setup of AnyConnect from our client. After installation, in the following configuration file i.e. Contractor.xml (c:/ProgramData/Cisco/Cisco AnyConnect Secure Mobility Client/Profile), change  the WindowsVPNEstablishment node value to “AllowRemoteUsers” instead of  “LocalUsersOnly”.

I done the above mentioned changes and tried to establish the VPN  connection. After I attempted to connect the VPN, it throws the same message and  the configuration which I changed from “LocalUsersOnly” to “AllowRemoteUsers” is  revoked.

Am I missing something?

[Dinesh Moudgil]

Hi Chetan,

This change would have to be done on the ASA since whenever you try to connect again with the modified policy, it gets updated by the policy pushed from the ASA  and the changes are reverted.

Please have your client configure the mentioned change so that it can be pushed from the firewall to all the clients.

Regards,
Dinesh Moudgil

P.S. Please rate helpful posts.

[Guido Arturo Catalano]

Thanks.

This is the content of the uploaded profile:

<?xml version="1.0" encoding="UTF-8"?>
<AnyConnectProfile xmlns="http://schemas.xmlsoap.org/encoding/">;
 <ClientInitialization>
  <WindowsVPNEstablishment>AllowRemoteUsers</WindowsVPNEstablishment>
 </ClientInitialization>
</AnyConnectProfile>

I'm using AnyConnect 3.1.13015

Thanks

Guido