Cisco AnyConnect client

[jjohnson36]

We got the following error message when we tried to open Cisco AnyConnect client "Connection attempt has timed out.  Please verify Internet connectivity".  We do have internet access.  We have Windows 7, 64-bit, SP1.  Is there a way to troubleshoot this problem?

Thanks.

[Anthony Brandelli]

Can you access the VPN gateway in a web browser, using https://<vpngatewayip>?

[jjohnson36]

Thanks for your prompt response, Anthony.  I cannot access the VPN gateway.  I got the error message "This page can't be displayed." when I typed https://<vpngatewayip>. ; Any other suggestions?  Thanks.

[Anthony Brandelli]

Sorry I should have been more specific, substitute <vpngatewayip> with what you connect to with Anyconnect, this is displayed on Anyconnect startup. Do you manage the ASA/ISR that the Anyconnect clients connect to?

[jjohnson36]

Thanks Anthony.  I don't quite understand your suggestions.  I tried both the vpngateway ip address and the Fully Qualified Domain Name, I still got the error message "This page can't be displayed".  Yes, I manage the ASA that Anyconnect clients connect to. Any suggestions are greatly appreciated.

Thanks.

[Anthony Brandelli]

Well to my knowledge Anyconnect uses port 443 initially to negotiate the TLS/SSL tunnel, then possibly after that it uses DTLS on a different port, or IPsec. If you can't access this in a browser then that means there are issues accessing the ASA.

Was this ever working or is this a new deployment? Are any clients working?

[jjohnson36]

Thanks so much for your prompt response, Anthony.  When the users are away from the office (home, hot spots, etc.), they are able to open and login Cisco AnyConnect client.  However, when they are in the office , they are unable to open Cisco Anyconnect client.  Cisco Anyconnect client would display the error message.  The office firewall is wide open.  There were no specific rules on the firewall that would block VPN traffic.

Thanks.

[Anthony Brandelli]

All of my Anyconnect clients connect to ISRs so I can't comment too much on the ASA config, but from the docs it seems in webvpn config mode you type "enable outside" to configure the interface it listens on, I suspect it doesn't work with traffic sourced internally but I don't have an ASA to test this. 

What is the use case of clients needing to connect to the ASA internally using Anyconnect?

[jjohnson36]

Thanks Anthony.  There was a routing issue on the internal firewall.  We were able to resolve the issue.  Users are now able to connect using Cisco AnyConnect client.  Thanks for your help.