Proxy Error message when Using AnyConnect and Okta with SAML

jackfait1 · ‎08-11-2021

For Logging into the VPN connection with AnyConnect, we are using SAML with Okta.

We have a PAC file set in our web browser/internet settings that direct traffics to a Web Proxy when Employees are connected on our Internal network or on VPN. - If the User is not on our network or VPN then the PAC file is ignored. User automatic configuration script is where PAC file is set.

The problem is when Users try to connect to AnyConnect, the browser window comes up to connect to Okta but an error says the proxy can't be reached. - This is the actual address of the proxy server and not the Pac file

The proxy won't be reached since the User is not connected to our network yet. I also have the same problem with Okta when trying to directly log into the ASA.

If you unselect - user automatic configuration script in the internet settings - then the Okta page will open and the user can connect to anyconnect.

It seems like something is being cached somewhere but I don't know if it is Windows Issue or Cisco issues?? It seems like a Windows Issue since that is where AnyConnect gets the proxy settings from.

Any help would be great.

Thanks,

jberoldo · ‎10-10-2023

Hello, I was just wondering if you were able to solve the problem, since this post is two years old and I am currently facing the same issue.

Thank you

jackfait1 · ‎10-10-2023

Hello.
We would just have people uncheck the setting to use the pac file in their web browser and then recheck it as a workaround.
We have since upgraded our ASA version and AnyConnect version since getting new Firepower devices, and allow people to use their Default OS Browser instead of the VPN client embedded browser to connect.

jberoldo · ‎10-10-2023

Hi!!
thanks for your quick response.
In our case we add an exception to the login url in the proxy that is momentarily working
Anyway, I don't know if it is the correct solution for this problem.
Thanks again!

jackfait1 · ‎10-10-2023

Hello,
I think we had a different issue. In our case the VPN client embedded browser was trying to use the proxy to connect. However, the proxy was not reachable till Users connected to our VPN. User's off VPN had direct access to the internet at the time. I am glad you got it fixed!