VIP Enterprise Gateway - Cisco AnyConnect client connection disconnects after 12 seconds after increasing the timeout

Products

• VIP Service

Issue/Introduction

If a PUSH is not accepted within ~12 seconds, the following error occurs on the Cisco AnyConnect client: "Connection attempt has failed due to network or PC issue.". 

Cause

The Cisco AnyConnect client missing the FQDN in the profile setup within the client AnyConnect XML

Resolution

• In addition to increating the timeout to 60 seconds (recommended), enable XML client profile on the Cisco ASDM.
• Navigate to Configuration > Remote Access VPN > Network (Client) Access > AnyConnect Client Profile.
• Edit or designate the HOST NAME value, then edit or designate the HOST ADDRESS using your publicly-facing FQDN hostname (must be public DNS resolvable).
• Save the changes, then allow the client to make an initial connection to pull down the new profile XML. 

If the client is unable to connect and pull down the updated data, the following lines can manually be added to the end of the existing profile XML file on the client system using an XML editor. (default file is default-profile.xml)  The location of the file is typically:

Window: %ProgramData%\Cisco\Cisco AnyConnect Secure Mobility Client\Profile
Mac: /opt/cisco/anyconnect/profile

Note: If the profile already contains a ServerList list section, replace the <HostAddress> value with the FQDN of your external hostname resolvable through public DNS.

<ServerList>
  <HostEntry>
    <HostName>sampleASA</HostName>
    <HostAddress>sampleASA.cisco.com</HostAddress>
  </HostEntry>
</ServerList>