RDP and Anyconnect failure

[wm2680001]

I am using Anyconnect (ver. 4.2.02075).

VPN is working from desktop, but doesn't work through RDP connection.

In the XML file the following settings about remote session was changed to:

<WindowsLogonEnforcement>SingleLocalLogon</WindowsLogonEnforcement>

<WindowsVPNEstablishment>AllowRemoteUsers</WindowsVPNEstablishment>

but anyconnect doesn't work: error "VPN establishment capability from a remote desktop is disabled.  A VPN connection will not be established."

Can you help with this issue?

Thank you!

[Dinesh Moudgil]

Hi wm2680001,

Please configure the anyconnect profile (.xml file) to be configured for "AllowRemoteUsers" as shown in the attached snippet.
This will allow the VPN sessions to be originated from remote machines as well.

For future reference:-
http://www.cisco.com/c/en/us/td/docs/security/vpn_client/anyconnect/anyconnect30/administration/guide/anyconnectadmin30/ac13vpnxmlref.html#40060

This change would have to be done on the ASA since whenever you try to connect again with the modified policy, it gets updated by the policy pushed from the ASA  and the changes are reverted.

Please have your ASA configured for the mentioned setting so that it can be pushed from the firewall to all the clients.

Regards,
Dinesh Moudgil

P.S. Please rate helpful posts.

[wm2680001]

Hi Dinesh, 

You're saying if it isn't done on the ASA, just locally on the machine, the modified policy won't take hold? Is there any possible way to do it just locally and have something that calls a modified profile xml file (which is what I did locally) on the local machine instead of getting it pushed from the ASA?

Thank you

[Dinesh Moudgil]

Hi wm2680001

The issue is every time client connects to VPN headend, it tries to fetch and confirm if there were any updates to the xml profile and will inheret them if there were any changes indeed. This is the expected behavior so this has to come from ASA.

Optionally, if you don't want all the users to get that option, you can create a separate group-policy for your account and define modified xml profile from the ASA.

Regards,
Dinesh Moudgil

P.S. Please rate helpful posts.

[valgardur]

Having the same problem, and not exactly sure where I can find the anyconnect profile (.xml) file. I tried under "C:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client" and updated a file called "AnyConnectLocalPolicy.xml".. but I still cannot connect.

I also do not see any attaced snippet.