We're having an issue with one particular user that when she initiates a VPN connection, it can take up to 11 minutes to complete the process. According to the AnyConnect logs, the area where it gets stuck is where the AnyConnect downloader is performing update checks. In the most recent incident, that entry shows in the logs and then, 9 1/2 minutes later, the next log entry says checking for profile updates. We're fairly certain that the ASA isn't actually downloading anything to the client. The client installed on her laptop is version 4.3 and the image we check for on the ASA is 3.1.0. We also don't have any of the additional checks enabled (file versions, registry entries, etc). In fact, the Secure Desktop Manager section of the ASA is totally blank and has no configuration at all. This doesn't happen all the time but does happen fairly regularly, at least twice a week.
I've tried watching the ASA logs while someone connects with the AnyConnect client but even with the logging set to debug levels, I get no indication of what's actually taking place on the client during the connection process except when phase 1 and phase 2 are completed and radius authentication is successful.
Has anyone ever seen anything like this before or, does anyone have any ideas as to where we can go to start checking what might be causing this delay?
Here's some more information about the connection;
ASA ASA 5508X running version 9.6(2)
AnyConnect Client version 4.3.01095
IPsec (IKE v2) tunnel (SSL is disabled)
Thanks!
