I use Cisco AnyConnect on my Windows 7 computer to make VPN connections. It also has capability to connect to WiFi. But I always had problems in connecting toWiFi with AnyConnect. Connection drops frequently and it keeps saying ‘Acquiring IP address‘.
As soon as the AnyConnect establishes a connection the internet connection drops on the PC. The AnyConnect client still thinks it is connected. Using an old HH3 with a Huawie modem does work but I don't really want o go back to that old kit. The last 3 Smart Hubs worked until they were replaced due to other failures. Recently, it has got the the point where the connection will drop out and reconnect 2 or 3 times per minute. That was really only noticeable when using a VPN connection over Cisco AnyConnect - otherwise browsing just appeared to be very slow at times. I found that disabling the WiFi and re-enabling it would provide relief for a few minutes. I have a user reporting that when they connect to the VPN they loose their internet connection. They can still access company intranet. We use Cisco anyconnect to access the VPN. They are using Windows 7. Full disclosure. This is my first VPN troubleshooting ticket. Typically, these third-party will enable WiFi Direct as “Split Tunnel” security vulnerability, forcing the system to disable the functionality. The only way to test whether this scenario is occurring in your particular situation is to disable Cisco AnyConnect or similar software, restart your machine and see if you are able to create a. AnyConnect brings the VPN adapter up and assigns DTLS MTU to it in anticipation that it will be able to connect via DTLS. The AnyConnect client is now connected and the user goes to a particular website. The browser sends TCP SYN and sets MSS = 1418-40 = 1378 in it. The HTTP-server on the inside of the ASA sends packets of size 1418.
AnyConnect installs a service called ‘Network Access Manager‘ which seems like takes over the native Windows WiFi connecting client. So when I click on the network icon in the System tray it says ‘No connections are available'(See below snapshot). Without AnyConnect, it always displays the WiFi connections available.
If you are facing the problem then you can try the following solution that worked for me.
- Open Services management console by running Services.msc from Run
- Find the service ‘Cisco AnyConnect Network Access Manager‘.
- Right click and stop the service.
- Now Cisco AnyConnect will say ‘NAM service unavailable‘
- Now Windows will use the native WiFi client to connect to the WiFi
- When you reboot your system, the NAM service will start and may cause problem again. You can disable this service in Services management console to prevent that.
AnyConnect has settings to disable the NAM feature. But that did not work for me. Even after disabling NAM service, I could not connect to WiFi. Windows network icon shows the WiFi connection but gives the error ‘Windows was not able to connect to…‘. I followed the below steps to do this.
- Opened Anyconnect window and click on Advanced.
- Clicked on ‘Networks’ tab in the left side pane.
- Clicked on Configuration tab. Changed the NAM to disabled as shown below.
Something strange would happen when I connected to a Firepower 2130 running Firepower Threat Defense with Cisco AnyConnect.
Basically, the AnyConnect client would contact the VPN gateway just fine, prompt for user credentials, authenticate and connect but then literally after about 3 seconds of being connected it would immediately drop and attempt to reconnect again. This would typically happen about two or three times before the VPN client would make the connection and stay connected and stable. I actually never had to re-enter my user credentials during this connect / reconnect process.
While there are some topics discussed that I found by doing a couple of searches, none of them explicitly talked about Firepower 2100 series appliances, Firepower Threat Defense, or Firepower Management Center (FMC) in particular. Most articles or forum discussions were centered around ASA Firewall topics, but I think the concept behind the fix is the same.
A little bit of background regarding what device(s) are at play here:
- Cisco Firepower Management Center 6.2.3.7-51 running on VMware
- Cisco Firepower 2130 Next Generation Firewall on Firepower Threat Defense 6.2.3.7-51
- Cisco AnyConnect Secure Mobility Client 4.5.05030 on Windows 10 64-bit
Let’s take a look at some logs to see the problem in action.
Some information seemed to point to DTLS as being the problem and while the link here suggests this on ASA releases 9.0 and 9.1, the topic of MTU size caught my eye. Some other posts I read mentioned MTU as well, so I figured I would change the default MTU size from 1406 to something different and see if this helped, and it did.
![Wifi Wifi](/uploads/1/1/9/6/119610766/300764185.jpg)
Let’s see the problem first hand. Here are the message history logs from within Cisco AnyConnect:
What is the workaround to solve this “reconnecting” behavior?
Let’s go into FMC and change the MTU settings for the Group Policy associated with your Remote Access VPN setup.
Navigate to Objects tab > VPN > Group Policy > NAME OF YOUR RA VPN GROUP POLICY > Click on the pencil “Edit” icon.
Once you are on the Edit Group Policy screen, go to the “AnyConnect” Tab > SSL Settings > Change MTU Size to 1300 Bytes.
Don’t forget to click on Save at the bottom and then deploy the changes to the firewall that AnyConnect clients are connecting to. Grab some coffee, and check the latest weather update (since FMC takes a while to push policy… ugh). Once it is done, let’s connect through VPN and take a look at those AnyConnect message history entries again.
Cisco Anyconnect Lose Internet Connection
The logs show that the VPN connection was made, and then no reconnects were tried after the successful connection. I let the client stay connected for a few minutes just to make sure everything was OK, then manually disconnected at 11:27:06.
While leaving the MTU setting at 1300 bytes may not be possible for whatever environment you are working in, for now this seems to be working just fine. At any given time we have only about 50 concurrent AnyConnect sessions, so it’s a fairly low volume of remote workers that are being supported. If any long-term issues arise from this setup, i’ll be sure to update this post.
Cisco Anyconnect Secure Mobility Client Free
Thanks for reading, good luck!