We’re using Azure SAML authentication with Cisco Secure Client, and are planning to enable Always-On VPN. Since the VPN client must reach Azure SAML endpoints to complete Single Sign-On, we need to add the relevant URLs to the Always-On allow host li...
Forum Posts
Hi everyone,I need some advice regarding the upgrade of my Duo Security Authentication Proxy to comply with the upcoming Certificate Authority bundle expiration (Action Required by Feb 2, 2026).My Current Setup:Firewall: Cisco FTDDuo Auth Proxy Versi...
Hi everyone,We are facing an intermittent issue with our AnyConnect VPN 2FA flow involving Microsoft Azure MFA.Architecture / Flow: Cisco AnyConnect Client -> Cisco ASA -> Cisco ISE (Acting as RADIUS Proxy) -> Windows NPS (with Azure MFA Extension) -...
Cisco IOS XE Software, Version 17.18.01a appxk9 None Smart License Noneuck9 None Smart License Nonesecurityk9 securityk9 Smart License securityk9ipbase ipbasek9 Smart License ipbasek9 No matter what example or guide I use, there is such a random am...
!! Last configuration change at 17:52:14 UTC Mon Dec 15 2025!version 15.9service timestamps debug datetime msecservice timestamps log datetime msecno service password-encryption!!! Last configuration change at 17:58:54 UTC Mon Dec 15 2025!version 15....
i want to establish a clientless SSL VPN connection to the ASA to download the AnyConnect clientsoftware.i logged in from remote host which is pc-c from browseri enteredhttps://209.165.200.226 for the SSL VPN but i cannot reach what is/are issues? p...
Hello ,I configured FlexVPN IKEv2 Remote Access VPN as guided herehttps://www.cisco.com/c/en/us/support/docs/security/flexvpn/200555-FlexVPN-AnyConnect-IKEv2-Remote-Access.html#toc-hId-936641904I started to notice I have issue loading the webpages su...
I've got a strange issue where an IKEv2 VPN terminated on an IOS G2 router is not setting the DNS suffix (DHCP option 15). This can be observed on both Windows (built-in VPN client) and Android (also built-in VPN client).The same router also has L2TP...
Good day!actually cannot find info...My config on ISE with 3rd party 2FA works fine...but for all VPN users.I have a several AD groups with different access levels defined on ISE.How and where on ISE i can make this happen?I have MAIN VPN policy set,...
Hi allI am setting up a remote access VPN from Windows clients to ASA version 9.3(3) using native IKEv2 on the client, and machine authentication only. Everything seems to work fine as far as the ASA is concerned, but immedaitely after the VPN negot...
Seems pretty simple but I've been stuck on this for a bit. I'm looking to disable the group selection within secure client/any connect. Simple enough on the ASA but from what I can tell they forgot to include that tick box in FDM(Firewall Device Mana...
Resolved! Tunnel to Palo Alto keeps going down
Verified configurations in the Palo Alto. The router has the crypto-map, transform-set, and keyring. I keep seeing syslog messages stating %CRYPTO-4-RECVD_PKT_INV_SPI from the source of the tunnel that keeps going down. The amount of time in-between ...
I changed my Windows password the night before. The next morning, I tried to connect to the VPN as usual, but I couldn't. The reboot has been done several times, but it does not improve. If you look at the message history, you see "There is no valid ...
1- Problem in switching tcp / udp2- After locking the device (iphone & Ipad) the connection is lost and the reconnect enters the loop mode, especially in DTLS3- OnDemand mode exacerbates this issueThis has nothing to do with updated versions of the o...
Dear Specialist,I am running IOS version 8.0(5) in cisco ASA 5520. This issue i am facing is that when the memory utilzation reaches 49 percent, the web-vpn users are not able to login as they are getting a blank page. The only error which is getting...
