cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
9910
Views
5
Helpful
9
Replies

Failed to get configuration from secure gateway. Contact your system administrator

maweigel
Beginner
Beginner

Hi,

i try to setup FlexVPN for anyconnect to a isr4331 headend.

I can successfully connect, and build a IKEv2 based tunnel. 

 

Then anyconnect pops up the following error: Failed to get configuration from secure gateway. Contact your system administrator.

 

As i understand it, this error can have many causes. How can i debug this problem? Anyconnect seems to provide NO DEBUGGING SUPPORT?

 

How can is the configuration transfered from the headend to the client? https? inside or outside the tunnel? 

Did the client receive the xml-file and reject its contents?

 

Any help?

 

Matthias

 

9 Replies 9

Rob Ingram
VIP Expert VIP Expert
VIP Expert

Hi @maweigel 

The physical routers do not support XML profile downloads only CSR1000v. By default the AnyConnect client will try to download the latest XML profile from the FlexVPN Hub router and the connection will fail. This can be disabled:

  • Locate the AnyConnectLocalPolicy.xml file in C:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client\ a
  • Change BypassDownloader value to True

HTH

Hi Rob,

 

thanks for the tip, will try that.

Do you know if this is a bug or a feature?

Per this guide, profile download should be possible: 

https://www.cisco.com/c/en/us/support/docs/security/flexvpn/200555-FlexVPN-AnyConnect-IKEv2-Remote-Access.html#anc9

I have ios-xe 16.9.6 on the isr4331 head.

 

Thanks!

 

Matthias

Hi Rob,

 

after i changed the BypassDownloader setting, the errormessage is now different:

"Automatic profile updates are disabled and the local VPN profile does not match the secure gateway VPN profile. Contact your system administrator."

 

In the profile XML file i have:

     <IKEIdentity>icn</IKEIdentity>

 

in the head router config i have:

 

crypto ikev2 profile icn
  match identity remote key-id icn

  anyconnect profile icn

 

 

crypto vpn anyconnect profile icn bootflash:/blabla-vpn.xml

 

 

 

How can i debug anyconnect profiles?

 

Hi There, 

 

you need to remove the following line from the config for the crypto ikev2 profile

 

anyconnect profile ***

 

and disable config download on the client.

 

this will then allow the vpn to build correctly

Rob Ingram
VIP Expert VIP Expert
VIP Expert

Actually that document was using a virtual image "Cisco Cloud Services Router running IOS XE 16.9.2" when written and there is a Cisco Live presentation that also only said this worked with CSR1000v, not physical hardware.

 

When I previously tested, bypassing the downloader made it work for me.

maweigel
Beginner
Beginner

Hi,

 

o.k. i had to open a TAC case about this.

 

Turns out, the anyconnect requirements are much more restrictive than i read from the docs.

 

1. The name of the profile file on the client must be acvpn.xml. NO OTHER NAME ALLOWED!

 

2. The name of the profile file on the router must be acvpn.xml. NO OTHER NAME ALLOWED!

 

3. The acvpn.xml on the router and on the client must be identical. Same content is not sufficient. Same md5 checksum (or similar) is required.

 

4. You cannot disable the checksum comparison. If the checksum is different, the connection fails. The BypassDownloader setting is irrelevant. If the xml files are different, the connection fails. The ISR4331 cannot used for Download anyway.

 

In summary, these "features" make anyconnect pretty unusable for any nontrivial deployment. If you deploy it, you can NEVER EVER change anything, because acvpn.xml will have to be updated on all clients and the headend simultaneously.

 

Best Regards

 

Matthias

Hi Matthias,

Can you please share your working config for anyconnect . I am trying on Cisco 4321 IOS-XE but getting connection fail even before prompting me username and password

 

Thanks

maweigel
Beginner
Beginner

Hi masterprince,

 

this is the second attempt at sending the config. My first reply it seems, has gone lost somewhere.

There probably will be more help for you, if you create a new topic with your config and debug logs. So many others will have a look at the problem.

Nevertheless attached is some redacted and commented version of my working config.

 

Best Regards

Matthias

masterprince
Beginner
Beginner

Thanks Matthias,

I will try and update

 

Regards,

MP

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Recognize Your Peers