Cisco Anyconnect VPN connection Issue from azure vm running Windows 11

Question

Cisco Anyconnect VPN connection Issue from azure vm running Windows 11

Mohith 1

I have a vm running on azure. I have installed Cisco Anyconnect Secure Mobility VPN Client.
I tried to connect to my organisation, but I am getting the following error.

 5:46:21 PM    Ready to connect.   
 5:46:42 PM    Contacting *************.com/2fa.   
 5:47:18 PM    User credentials entered.   
 5:47:21 PM    Please respond to banner.   
 5:47:23 PM    User accepted banner.   
 5:47:23 PM    Establishing VPN session...   
 5:47:23 PM    The AnyConnect Downloader is performing update checks...   
 5:47:23 PM    Checking for profile updates...   
 5:47:23 PM    Checking for product updates...   
 5:47:23 PM    Establishing VPN session...   
 5:47:23 PM    Establishing VPN - Initiating connection...   
 5:47:24 PM    VPN establishment capability from a remote desktop is disabled.  A VPN connection will not be established.   
 5:47:24 PM    AnyConnect was not able to establish a connection to the specified secure gateway. Please try connecting again.   
 5:47:25 PM    Ready to connect.

How would I handle this situation.

Pete 6 Reputation points

2022-04-21T08:40:00.047+00:00

you can't do Anyconnect VPN connection from inside virtual machine*), your log states that clearly
VPN establishment capability from a remote desktop is disabled. A VPN connection will not be established.

This is because Ciscoanyconnect program checks if its operating system is running in RDP mode and tells that to Cisco gateway, which denies the connection than.
There are some workarounds, i.e. in Hyper-V session if you change the guest session from Enhanced mode to Basic than Anyconnect will be tricked to thinking it is ok and lets you connect, you can change to Enhanced mode afterwards safely.

Hovewer this won't work for Azure VM afaik, as tenants do not have an access to hypervisor.
But, if you would run nested virtualization (an Azure VM with windows server having Hyper-V role and the VMs will be on top of that), then you will be able to use this Anyconnect trick.

Software that will filter an Windows RDP checks might be also a more generalized solution to Anyconnect's policy constraints, but I am unaware of any such soft.
https://stackoverflow.com/questions/159910/determine-if-a-program-is-running-on-a-remote-desktop
Valentin Arroyo 0 Reputation points

2023-04-17T16:51:48.88+00:00

@Pete had the solution for me. I'm in the testing stages of my AnyConnect deployment. I would get connected and immediately disconnected. Different from the logs you provided, but similar behavior. I'm using Cisco Meraki with Cisco AnyConnect with Azure AD auth. All guides indicated my config was correct. After disabling the enhanced session, my AnyConnect begin to work. Thank you for your input/suggestion! I've been banging my head on this issue for a few days now. 9:08:44 AnyConnect VPN connection event msg: Server IP=host.server.ip Server port=443 Prot[TCP] Peer IP=client.ip Peer port=33032 conn_id[3767] Connection closed. 9:08:28 AnyConnect VPN connection event msg: Server IP=host.server.ip Server port=443 Prot[TCP] Peer IP=client.ip Peer port=33032 conn_id[3767] TLSv1.2 connection established.

2 answers

Your answer

Pete 6 Reputation points

2022-04-21T08:40:00.047+00:00

you can't do Anyconnect VPN connection from inside virtual machine*), your log states that clearly
VPN establishment capability from a remote desktop is disabled. A VPN connection will not be established.

This is because Ciscoanyconnect program checks if its operating system is running in RDP mode and tells that to Cisco gateway, which denies the connection than.
There are some workarounds, i.e. in Hyper-V session if you change the guest session from Enhanced mode to Basic than Anyconnect will be tricked to thinking it is ok and lets you connect, you can change to Enhanced mode afterwards safely.

Hovewer this won't work for Azure VM afaik, as tenants do not have an access to hypervisor.
But, if you would run nested virtualization (an Azure VM with windows server having Hyper-V role and the VMs will be on top of that), then you will be able to use this Anyconnect trick.

Software that will filter an Windows RDP checks might be also a more generalized solution to Anyconnect's policy constraints, but I am unaware of any such soft.
https://stackoverflow.com/questions/159910/determine-if-a-program-is-running-on-a-remote-desktop
Valentin Arroyo 0 Reputation points

2023-04-17T16:51:48.88+00:00

@Pete had the solution for me. I'm in the testing stages of my AnyConnect deployment. I would get connected and immediately disconnected. Different from the logs you provided, but similar behavior. I'm using Cisco Meraki with Cisco AnyConnect with Azure AD auth. All guides indicated my config was correct. After disabling the enhanced session, my AnyConnect begin to work. Thank you for your input/suggestion! I've been banging my head on this issue for a few days now. 9:08:44 AnyConnect VPN connection event msg: Server IP=host.server.ip Server port=443 Prot[TCP] Peer IP=client.ip Peer port=33032 conn_id[3767] Connection closed. 9:08:28 AnyConnect VPN connection event msg: Server IP=host.server.ip Server port=443 Prot[TCP] Peer IP=client.ip Peer port=33032 conn_id[3767] TLSv1.2 connection established.

Answer 1

risolis 8,741

Hello @Mohith

Do you have the following settings on your Vnet or on your hub-spoke topology?

1-Azure Traffic Manager
2-DNS,
3-UDR

Regards,

Mohith 1 Reputation point

2022-03-07T20:38:01.197+00:00

Hi @risolis

Thank You for your interest.

I have it on Vnet.

Warm Regards
Mohith
risolis 8,741 Reputation points

2022-03-07T21:00:53.733+00:00

@Mohith

Did you check the settings stated before?

Also, I wonder if you have any NSG rule on your resource or any third-party antivirus....
Mohith 1 Reputation point

2022-03-07T21:14:42.677+00:00
@risolis

DNS is set to default in vnet settings

No firewall exits in vnet.

I have not installed any antivirus in the vm or in the resource.

There are NSG rules defined

Inbound Rules:

Outbound Rules:
Mohith 1 Reputation point

2022-03-07T21:21:43.037+00:00

@risolis

I haven't done much of configurations.

I have just created a VM running windows 11. with public ip for me to connect via RDP.
I have installed the Cisco AnyConnect Secure Mobility Client in the VM and inputted the VPN address and credentials.
and I am receiving this log in the software.

This is a fresh resource group.

In my previous resource group I had tried a whole lot of configuration both on OS and in Azure Group network settings.

I couldn't get it right so I am reaching out for the community help.
risolis 8,741 Reputation points

2022-03-07T21:28:43.403+00:00

Sure @Mohith

I am glad to assist you as well as trying to get the resolution for this...

Let me focused on the VM itself and I am thinking of the following features that you may need to disable:

-Internet Connection Service

-Internet Connection Sharing

Cheers!
Mohith 1 Reputation point

2022-03-07T21:40:40.9+00:00

Thank You @risolis

I apologise if I got you wrong.

In the VM I didn't find it, I tried following this https://www.thewindowsclub.com/disable-internet-connection-sharing-ics-in-windows-10

please find the screenshot.
Mohith 1 Reputation point

2022-03-07T21:45:36.85+00:00

@risolis

I did enable Ethernet 2. Then I get Sharing tab in the above window.
and inside "Allow other network users ...." option is unchecked.

Thank You
risolis 8,741 Reputation points

2022-03-07T21:49:22.197+00:00

@Mohith

Your welcome.... Did it work this time?
Mohith 1 Reputation point

2022-03-07T21:51:06.6+00:00

@risolis

No, it is still not working and I have disabled both
Mohith 1 Reputation point

2022-03-07T22:01:57.61+00:00

@risolis

Would you be kind enough to help me understand what does line 12 in the log say.
risolis 8,741 Reputation points

2022-03-07T22:02:05.603+00:00

Ok understood....

Do you NAT running ?

I know you showed me your NSG rules but .... Have you checked your Effective routes from the VM that is having issues?

Thanks for your time
risolis 8,741 Reputation points

2022-03-07T22:08:09.267+00:00

Humm great question... Which AnyConnect VPN version are you running?
Mohith 1 Reputation point

2022-03-07T22:33:44.147+00:00

Yes, the NAT is running.

In the VM.

I navigated to "Windows Defender Firewall with Advanced Security",
where I added a new rule between any program running on the system to establish a connection without any restrictions

still not working
Mohith 1 Reputation point

2022-03-07T22:37:10.653+00:00

@risolis Thank You for your invaluable Time to help me resolve this problem.

is there anything I should consider doing in gateway

Answer 2

risolis 8,741

Share the logs pls

Mohith 1 Reputation point

2022-03-07T22:38:39.187+00:00

its still the same log after trying all the settings
risolis 8,741 Reputation points

2022-03-07T22:49:49.94+00:00

well at this point , lets do a recap about the TS steps so far...

-Review UDR table(User define routes)
-Effective routes table >> Could be either way from the "Virtual machine(NIC adapter) or Vnet"
-NAT feature
-NSG rules
-Review DNS set up or Resolution
-ICMP/PSping or traceroute/Tracert command
-Netstat command (Listening ports)
-Firewall/Antivirus blocking the app to work properly
-No traffic manager (Correct me if am i am wrong)
-Internet Connection Service setting >>> (Review from services.msc)
-Internet Connection Sharing setting
-VPN app version/release
-Firewall appliance setting

I am missing any step done until now?
risolis 8,741 Reputation points

2022-03-07T22:56:15.57+00:00

@Mohith
Mohith 1 Reputation point

2022-03-07T23:01:13.047+00:00

Well, If you have time.

I would like to share my screen if you could join this meet

https://meet.google.com/gdg-dapb-wzx

then a solution could be posted.

apologise if I am taking a wrong step

Share via

Cisco Anyconnect VPN connection Issue from azure vm running Windows 11

2 answers

Your answer