ASA – F1-CONSULT https://www.f1-consult.com Our Network For Your Network Wed, 15 Nov 2023 08:54:05 +0000 en-US hourly 1 https://wordpress.org/?v=7.1.3 https://www.f1-consult.com/wp-content/uploads/2018/01/cropped-F1-CONSULT-favicon-32x32.png ASA – F1-CONSULT https://www.f1-consult.com 32 32 CISCO – AnyConnect – The VPN connection to the secure gateway was interrupted and could not be automatically re-established https://www.f1-consult.com/cisco/cisco-security/anyconnect/anyconnect/ Wed, 15 Nov 2023 08:54:05 +0000 https://www.f1-consult.com/?p=4906

The VPN connection to the secure gateway was interrupted and could not be automatically re-established. A new connection is necessary, which requires re-authentication.

Client Issue:

  • Flakey connections
  • nondeterministic reconnects

Trouble shooting:

  • Does the client have IPv4 or IPv6 or dual stack in local LAN?
  • Does the local provider provide IPv4 or IPv6 or dual stack in local LAN?
  • IPv4 and IPv6 Traceroute from the vpn client towards the VPN gateways
  • If there are multiple gateways, traceroute to all of them
  • Check MTU Size:

Analysis:

  • Is the client next hop on the provider side showing 192.0.0.1 in the traceroue?
  • If so, that’s an indication of them having deployed DS-LITE
  • DS-Lite is a IPv6 transition mechanism widely deployed in Europe by cable providers such as Liberty Global (like UPC, Unitymedia, …), like Vodafone, Versatel, Kabel Deutschland and others.
  • That goes together with AFTR (carrier grade NAT system) to transition users from their native IPv6 home connections to the IPv4 world.
  • Therefore multiple users share a single external IPv4 address using this system.
  • Please check rfc6333 for more information
  • That doesn’t go well with VPN Tunnel technologies like Cisco AnyConnect Secure Mobility Client

Solution:

  • Open a ticket with the DSL provider and ask them to change your connection from DS-LITE towards DS.
  • Most cases they need a valid reason to do so. Tell them that you need native dual stack for business so that your VPN client can work properly.
  • Good Luck!
]]> CISCO – AnyConnect – Windows Autostart https://www.f1-consult.com/cisco/cisco-security/anyconnect/anyconnect-2/ Wed, 15 Nov 2023 08:43:41 +0000 https://www.f1-consult.com/?p=4910

CISCO Anyconnect Autostart

Windows:

\Computer\HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cisco AnyConnect Secure Mobility Agent for Windows"

Autostart enabled:

"C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe" -autolaunched

Autostart disabled:

"C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe"
]]> CISCO – AnyConnect – AnyConnect Profiles location https://www.f1-consult.com/cisco/cisco-security/anyconnect/anyconnect-2-2/ Tue, 22 Mar 2022 21:42:12 +0000 https://www.f1-consult.com/?p=4836

Where are the AnyConnect Profiles located?

XML and profile files are stored locally to the users machine.The location varies based on OS.

Windows XP:

%ALLUSERSPROFILE%\Application Data\Cisco\Cisco AnyConnect Secure Mobility Client\Profile

Windows Vista:

%ProgramData%\Cisco\Cisco AnyConnect Secure Mobility Client\Profile

Windows 7:

%ProgramData%\Cisco\Cisco AnyConnect Secure Mobility Client\Profile

Windows 8:

%ProgramData%\Cisco\Cisco AnyConnect Secure Mobility Client\Profile

Windows 10:

%ProgramData%\Cisco\Cisco AnyConnect Secure Mobility Client\Profile

Mac OS X:

/opt/cisco/anyconnect/profile

Linux.:

/opt/cisco/anyconnect/profile
]]> CISCO ASA – %ASA-6-722036 Transmitting large packet 1418 (threshold 1347) https://www.f1-consult.com/cisco/cisco-security/asa/transmitting-large-packet/ Fri, 05 Feb 2021 10:55:37 +0000 https://www.f1-consult.com/?p=4686

Problem:

On ASA syslog you seen the Anyconnect warning message

%ASA-6-722036: Group <ac_users_group> User <vpn> IP <> Transmitting large packet 1418 (threshold 1347)

Solution:

!
sysopt conn tcpmss 1460
!
group-policy DfltGrpPolicy attributes 
webvpn
anyconnect mtu 1300
anyconnect ssl df-bit-ignore enable
!

In order to eliminate this visible transition of DTLS > TLS,  the administrator can configure a separate tunnel group for TLS only access for users that have trouble with the establishment of the DTLS tunnel (such as due to firewall restrictions).

  1. The best option is to set the AnyConnect MTU value to be lower than the TLS MTU, which is then negotiated.

group-policy ac_users_group attributes
webvpn
anyconnect mtu 1300

This makes TLS and DTLS MTU values equal. Reconnections are not seen in this case.

  1. The second option is to allow fragmentation.

group-policy ac_users_group attributes
webvpn
anyconnect ssl df-bit-ignore enable

With fragmentation, large packets (whose size exceeds the MTU value) can be fragmented and sent through the TLS tunnel.

  1. The third option is to set the Maximum Segment Size (MSS) to 1460 as follows:

sysopt conn tcpmss 1460

In this case, the TLS MTU will be 1427 (RC4/SHA1) which is larger than the DTLS MTU 1418 (AES/SHA1/LZS). This should resolve the issue with TCP from the ASA to the AnyConnect client (thanks to MSS), but large UDP traffic from the ASA to the AnyConnect client might suffer from this as it will be dropped by the AnyConnect client due to the lower AnyConnect client MTU 1418. If sysopt conn tcpmss is modified, it might affect other features such as LAN-to-LAN (L2L) IPSec VPN tunnels.

Reference:

https://community.cisco.com/t5/vpn/anyconnect-issue/td-p/2708533

]]> CISCO ASA LDAP AAA Error ‘AAA Server has been removed’ https://www.f1-consult.com/cisco/cisco-security/asa/ldap-aaa-error-aaa-server-has-been-removed/ Tue, 20 Feb 2018 11:19:54 +0000 https://www.f1-consult.com/?p=3363 Problem:

Attempting to test AAA authentication via LDAP to a Windows domain Controller.

AAA Server has been removed

Authentication test to host {IP-Address} failed. Following error occurred – ERROR: Authentication Server not responding: AAA Server has been removed

Solution:

This is a terribly ambiguous error! What it means is that the ASA cannot bind to active directory, either because:

  • The ASA bind account password is wrong.
  • The ASA bind username, (or path to the user object) is wrong.
  • You have set the LDAP server group to use LDAPS (port 636) and the server specified as an LDAP  host is not authenticating via LDAPS.
  • There is no connectivity between the ASA and the LDAP server.

You can narrow it down by running the following debug:

debug ldap 255

In the following output you can see either the username or the password is wrong:

ASA(config)# debug ldap 255
debug ldap  enabled at level 255
[-2147483629] Session Start
[-2147483629] New request Session, context 0x00007fffbcc69c88, reqType = Authentication
[-2147483629] Fiber started
[-2147483629] Creating LDAP context with uri=ldap://192.168.110.10:389
[-2147483629] Connect to LDAP server: ldap://192.168.110.10:389, status = Successful
[-2147483629] supportedLDAPVersion: value = 3
[-2147483629] supportedLDAPVersion: value = 2
[-2147483629] Binding as asa
[-2147483629] Performing Simple authentication for asa to 192.168.110.10
[-2147483629] Simple authentication for asa returned code (49) Invalid credentials
[-2147483629] Failed to bind as administrator returned code (-1) Can't contact LDAP server
[-2147483629] Fiber exit Tx=207 bytes Rx=720 bytes, status=-2
[-2147483629] Session End

In the following output you can see the firewall is trying to connect over LDAPS but the server is not configured, (or not answering on TCP 636):

ASA(config)# debug ldap 255
debug ldap  enabled at level 255
[-2147483625] Session Start
[-2147483625] New request Session, context 0x00007fffbcc69c88, reqType = Authentication
[-2147483625] Fiber started
[-2147483625] Creating LDAP context with uri=ldaps://192.168.110.10:636
[-2147483625] Connect to LDAP server: ldaps://192.168.110.10:636, status = Failed
[-2147483625] Unable to read rootDSE. Can't contact LDAP server.
[-2147483625] Fiber exit Tx=0 bytes Rx=0 bytes, status=-2
[-2147483625] Session End

 

For us the issue had been nailed down to Active Directory Group Policies based on the following message: “A stronger authentication method is required for this server”

You you need to change the following:

  • Domain controller: LDAP server signing requirements to NONE
  • Network security:LDAP client signing requirements to NEGOTIATE

cucm_ldap_problem4

 

Reference:

https://www.petenetlive.com/KB/Article/0001271
http://mehmetyeni.com/cucm-ldap-connection-problem-error-while-connecting-to-ldapip-address389-null/

]]>