AnyConnect question

Similar Questions

• Basic question Anyconnect VPN

  Hi I'm new Anyconnect VPN. These are fundamental questions. The first step to set up the vpn is download image. What is this image? I noticed that the configuration of the VPN does not contain some general vpn configuration steps such as crypto isakmp policy and crypto ipsec etc. Maybe the image contains all of this information? If so, how to get the image? Thank you

  IPsec is not a kind of SSL. It's a total different encryption mechanism.

  IPsec uses pre-shared keys (almost always) and is so symmetric cryptography (the two peers have the same "secret"). Until there are 4-5 ears it was predominant VPN technology and is still widely used, particularly in site-to-site VPN connections.

  SSL uses a PKI (PKI) with a private key ('secret') not shared between peers and therefore asymmetric. More new remote access VPN in recent years are based on SSL. SSL does not use lines of configuration of ipsec crypto or crypto isakmp but instead relies on certificates and trustpoints.

  Complicating the landscape there is a new safer type of VPN IPsec is IKEv2. It is not widely adopted in my experience, but is increasingly used by organizations and agencies who need to comply to strict government standards.

• Cisco AnyConnect VPN question

  I am ASA 5505 that I am of is running correctly by using the AnyConnect client. The question is, can I connect to the fine external interface, but cannot ping or attach them to any host on the inside. When I connect, it accepts the user name and password, and I can run the ASDM or SSH to the firewall very well, but not further. In the control, after I log in, I get an IP address inside, of the order of 10.7.30.x as expected.

  Following configuration:

  : Saved
  :
  ASA Version 8.2 (5)
  !
  asa5505 hostname
  domain BLA
  activate the password * encrypted
  passwd * encrypted
  no names

  !
  interface Ethernet0/0
  switchport access vlan 2
  !
  interface Ethernet0/1
  !
  interface Ethernet0/2
  !
  interface Ethernet0/3
  switchport access vlan 150
  !
  interface Ethernet0/4
  !
  interface Ethernet0/5
  !
  interface Ethernet0/6
  !
  interface Ethernet0/7
  !
  interface Vlan1
  nameif inside
  security-level 100
  IP 10.7.30.1 255.255.255.0
  !
  interface Vlan2
  nameif outside
  security-level 0
  IP EXTERNAL IP 255.255.255.128
  !
  interface Vlan150
  nameif WLAN_GUESTS
  security-level 50
  IP 10.7.150.1 255.255.255.0
  !
  boot system Disk0: / asa825 - k8.bin
  config to boot Disk0: / running-config
  passive FTP mode
  clock timezone STD - 7
  DNS server-group DefaultDNS
  domain BLA
  permit same-security-traffic intra-interface
  object-group service tcp Webaccess
  port-object eq www
  EQ object of the https port
  object-group network McAfee
  network-object 208.65.144.0 255.255.248.0
  network-object 208.81.64.0 255.255.248.0
  access extensive list ip 10.7.30.0 outside_1_cryptomap allow 255.255.255.0 192.168.24.0 255.255.252.0
  access extensive list ip 10.7.30.0 inside_nat0_outbound allow 255.255.255.0 192.168.24.0 255.255.252.0
  access extensive list ip 10.7.30.0 inside_nat0_outbound allow 255.255.255.0 172.16.10.0 255.255.255.0
  outside_access_in list extended access permit tcp any host 159.87.30.252 eq smtp
  outside_access_in list extended access permit tcp any host 159.87.30.136 Webaccess object-group
  outside_access_in list extended access permit tcp any host 159.87.30.243 Webaccess object-group
  access-list extended outside_access_in permit tcp host 159.87.70.66 host 159.87.30.251 eq lpd
  outside_access_in list extended access permit tcp any host 159.87.30.252 Webaccess object-group
  outside_access_in list extended access permit tcp any host 159.87.30.245 Webaccess object-group
  outside_access_in list extended access permitted tcp object-group McAfee any eq smtp
  permit access list extended ip 172.16.10.0 outside_access_in 255.255.255.0 10.7.30.0 255.255.255.0
  outside_access_in list extended access permit ip host 159.87.64.30 all
  standard access list vpn_users_splitTunnelAcl allow 10.7.30.0 255.255.255.0
  IPS_TRAFFIC of access allowed any ip an extended list
  access extensive list ip 10.7.30.0 outside_nat0_outbound allow 255.255.255.0 any
  inside_access_in list extended access permit udp 10.7.30.0 255.255.255.0 any eq snmp
  access extensive list ip 10.7.30.0 outside_cryptomap allow 255.255.255.0 172.16.10.0 255.255.255.0
  pager lines 24
  Enable logging
  asdm of logging of information
  host of logging inside the 10.7.30.37
  Debugging trace record
  Within 1500 MTU
  Outside 1500 MTU
  MTU 1500 WLAN_GUESTS
  local pool VPN_POOL 10.7.30.190 - 10.7.30.200 255.255.255.0 IP mask
  no failover
  ICMP unreachable rate-limit 1 burst-size 1
  ASDM image disk0: / asdm-645 - 206.bin
  don't allow no asdm history
  ARP timeout 14400
  Global 1 interface (outside)
  NAT (inside) 0-list of access inside_nat0_outbound
  NAT (inside) 1 0.0.0.0 0.0.0.0
  NAT (outside) 0-list of access outside_nat0_outbound
  NAT (WLAN_GUESTS) 1 0.0.0.0 0.0.0.0
  public static 159.87.30.251 (Interior, exterior) 10.7.30.50 netmask 255.255.255.255
  public static 159.87.30.245 (Interior, exterior) 10.7.30.53 netmask 255.255.255.255
  public static 159.87.30.252 (Interior, exterior) 10.7.30.30 netmask 255.255.255.255
  public static 159.87.30.243 (Interior, exterior) 10.7.30.19 netmask 255.255.255.255
  public static 159.87.30.136 (Interior, exterior) 10.7.30.43 netmask 255.255.255.255
  Access-group inside_access_in in interface inside the control plan
  Access-group outside_access_in in interface outside
  Route outside 0.0.0.0 0.0.0.0 159.87.30.254 1
  Route inside 172.16.1.0 255.255.255.0 10.7.30.1 1
  Timeout xlate 03:00
  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
  timeout tcp-proxy-reassembly 0:01:00
  Floating conn timeout 0:00:00
  dynamic-access-policy-registration DfltAccessPolicy
  AAA-server ADWM-FPS-02 nt Protocol
  AAA-server ADWM-FPS-02 (inside) host 10.7.30.32
  Timeout 5
  auth-domain NT ADWM-FPS-02 controller
  AAA-server ADWM-FPS-02 (inside) host 10.7.30.49
  auth-DC NT ADWM-DC02
  AAA authentication http LOCAL console
  AAA authentication LOCAL telnet console
  the ssh LOCAL console AAA authentication
  Enable http server
  http 206.169.55.66 255.255.255.255 outside
  http 206.169.50.171 255.255.255.255 outside
  http 10.7.30.0 255.255.255.0 inside
  http 206.169.51.32 255.255.255.240 outside
  http 159.87.35.84 255.255.255.255 outside
  SNMP-server host within the 10.7.30.37 community * version 2 c
  location of the SNMP server *.
  contact SNMP Server
  Community SNMP-server
  Server enable SNMP traps snmp authentication linkup, linkdown cold start
  Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac
  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
  Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac
  Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac
  Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
  Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
  Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac
  Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
  Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac
  Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac
  life crypto ipsec security association seconds 28800
  Crypto ipsec kilobytes of life - safety 4608000 association
  Crypto-map dynamic outside_dyn_map pfs set 20 Group1
  card crypto outside_map 1 match address outside_1_cryptomap
  peer set card crypto outside_map 1 206.169.55.66
  map outside_map 1 set of transformation-ESP-3DES-MD5 crypto
  card crypto outside_map 2 match address outside_cryptomap
  peer set card crypto outside_map 2 159.87.64.30
  card crypto outside_map 2 game of transformation-ESP-AES-192-SHA
  map outside_map 65535-isakmp ipsec crypto dynamic outside_dyn_map
  outside_map interface card crypto outside
  Crypto ca trustpoint *.
  Terminal registration
  full domain name *.
  name of the object *.
  MYKEY keypairs
  Configure CRL
  Crypto ca trustpoint A1
  Terminal registration
  fqdn ***************
  name of the object *.
  MYKEY keypairs
  Configure CRL
  Crypto ca trustpoint INTERMEDIARY
  Terminal registration
  no client-type
  Configure CRL
  Crypto ca trustpoint _SmartCallHome_ServerCA
  Configure CRL
  Crypto ca trustpoint ASDM_TrustPoint0
  Configure CRL
  Crypto ca trustpoint ASDM_TrustPoint1
  Configure CRL
  ca encryption certificate chain *.
  certificate ca 0301
  BUNCH OF STUFF
  quit smoking
  A1 crypto ca certificate chain
  OTHER LOTS of certificate
  quit smoking
  encryption ca INTERMEDIATE certificate chain
  YET ANOTHER certificate
  quit smoking
  Crypto ca certificate chain _SmartCallHome_ServerCA
  certificate ca LAST BOUQUET
  quit smoking
  crypto ISAKMP allow outside
  crypto ISAKMP policy 10
  preshared authentication
  3des encryption
  sha hash
  Group 2
  life 86400
  No encryption isakmp nat-traversal
  Telnet 10.7.30.0 255.255.255.0 inside
  Telnet timeout 30
  SSH 206.169.55.66 255.255.255.255 outside

  SSH timeout 5
  Console timeout 0
  management-access inside
  dhcpd 4.2.2.2 dns 8.8.8.8
  !
  dhcpd address 10.7.150.10 - 10.7.150.30 WLAN_GUESTS
  enable WLAN_GUESTS dhcpd
  !

  a basic threat threat detection
  Statistics-list of access threat detection
  no statistical threat detection tcp-interception
  SSL encryption rc4 - md5 of sha1
  SSL-trust A1 out point
  WebVPN
  allow outside
  AnyConnect essentials
  SVC disk0:/anyconnect-dart-win-2.5.2019-k9.pkg 1 image
  enable SVC
  attributes of Group Policy DfltGrpPolicy
  Protocol-tunnel-VPN IPSec l2tp ipsec svc webvpn
  internal VPNUsers group strategy
  Group Policy VPNUsers attributes
  value of server DNS 10.7.30.20
  Protocol-tunnel-VPN IPSec l2tp ipsec svc webvpn
  Split-tunnel-policy tunnelspecified
  value of Split-tunnel-network-list vpn_users_splitTunnelAcl
  dwm2000.WM.State.AZ.us value by default-field
  Split-dns value dwm2000.wm.state.az.us
  username HCadmin password * encrypted privilege 15
  attributes global-tunnel-group DefaultWEBVPNGroup
  address VPN_POOL pool
  authentication-server-group ADWM-FPS-02
  strategy - by default-VPNUsers group
  tunnel-group 206.169.55.66 type ipsec-l2l
  IPSec-attributes tunnel-group 206.169.55.66
  pre-shared key *.
  tunnel-group 159.87.64.30 type ipsec-l2l
  IPSec-attributes tunnel-group 159.87.64.30
  pre-shared key *.
  !
  class-map IPS_TRAFFIC
  corresponds to the IPS_TRAFFIC access list
  class-map inspection_default
  match default-inspection-traffic
  !
  !
  type of policy-card inspect dns preset_dns_map
  parameters
  message-length maximum 512
  Policy-map global_policy
  class inspection_default
  inspect the preset_dns_map dns
  inspect the ftp
  inspect h323 h225
  inspect the h323 ras
  inspect the rsh
  inspect the rtsp
  inspect esmtp
  inspect sqlnet
  inspect the skinny
  inspect sunrpc
  inspect xdmcp
  inspect the sip
  inspect the netbios
  inspect the tftp
  inspect the icmp
  Review the ip options
  class IPS_TRAFFIC
  IPS inline help
  !
  global service-policy global_policy
  field of context fast hostname
  anonymous reporting remote call
  call-home
  Profile of CiscoTAC-1
  no active account
  http https://tools.cisco.com/its/service/oddce/services/DDCEService destination address
  email address of destination [email protected] / * /
  destination-mode http transport
  Subscribe to alert-group diagnosis
  Subscribe to alert-group environment
  Subscribe to alert-group monthly periodic inventory
  monthly periodicals to subscribe to alert-group configuration
  daily periodic subscribe to alert-group telemetry
  Cryptochecksum:e70de424cf976e0a62b5668dc2284587
  : end
  ASDM image disk0: / asdm-645 - 206.bin
  ASDM location 159.87.70.66 255.255.255.255 inside
  ASDM location 208.65.144.0 255.255.248.0 inside
  ASDM location 208.81.64.0 255.255.248.0 inside
  ASDM location 172.16.10.0 255.255.255.0 inside
  ASDM location 159.87.64.30 255.255.255.255 inside
  don't allow no asdm history

  Anyone have any ideas?

  Hello

  Please, add this line in your configuration and let me know if it works:

  access extensive list ip 10.7.30.0 inside_nat0_outbound allow 255.255.255.0 10.7.30.0 255.255.255.0

  I ask you to add that it is because you have not specified any exceptions for the return shipping. Once you add to it, will allow you to go through the tunnel VPN, packets back. When this command is not there, you will be able to access everything on the SAA but nothing behind it.

  Let me know if it helps.

  Thank you

  Vishnu

• AnyConnect VPN Mobile disabled 5505 SEC no more questions

  Hi all

  I have a 5505-SEC-BUN-K9, must purchase a license of Mobile Anyconnect vpn.

  For the question now, I was able to active the anyconnect for mobile but the sec as well as features all failed. How can I check the question?

  The devices allowed for this platform:
  The maximum physical Interfaces: 8 perpetual
  VLAN: 20 unrestricted DMZ
  Double ISP: Activated perpetual
  VLAN Trunk Ports: 8 perpetual
  Guests of the Interior: perpetual unlimited
  Failover: Active / standby perpetual
  Encryption - A: enabled perpetual
  AES-3DES-Encryption: activated perpetual
  AnyConnect Premium peers: 2 perpetual
  AnyConnect Essentials: 25 perpetual
  Counterparts in other VPNS: 25 perpetual
  Total VPN counterparts: 25 perpetual
  Shared license: disabled perpetual
  AnyConnect for Mobile: 76 days allowed
  AnyConnect Cisco VPN phone: disabled perpetual
  Assessment of Advanced endpoint: disabled perpetual
  Proxy UC phone sessions: 2 perpetual
  Proxy total UC sessions: 2 perpetual
  Botnet traffic filter: disabled perpetual
  Intercompany Media Engine: Disabled perpetual
  Cluster: Disabled perpetual
   
  Internal guests: 10
  Failover: disabled
  Encryption - A: enabled
  Encryption-3DES-AES: enabled
  Security contexts: by default
  GTP/GPRS: disabled
  Premium AnyConnect peers: by default
  Other VPN peers: by default
  Assessment of Advanced endpoint: disabled
  AnyConnect for Mobile: enabled
  AnyConnect Cisco VPN phone: disabled
  Shared license Premium AnyConnect server: disabled
  Sharing license: disabled
  Proxy sessions for the UC phone: by default
  Total number of Sessions of Proxy UC: default
  AnyConnect Essentials: enabled
  Botnet traffic filter: disabled
  Intercompany media engine: disabled
  Cluster license: disabled

  Have you tried to re-apply your activation key for the license of security more?

  If you don't have it available, you may need to open a TAC case to get worldwide license team to regenerate it for you.

• AnyConnect optimized gateway selection question

  Hello

  I'm evaluating Cisco Anyconnect VPN for my business. Can someone let me know what will happen if optimized customer selected gateway is full?

  Thank you

  Deepak

  Hello

  With an optimal selection of front door the first time that AC is running on the machine check the answer RTT for each server / gateway configured in the XML file and use the one with the lowest value as the main access door.

  These results will be cached by the client, so in case the primary gateway fails or is not responding somehow, HQ will automatically use the second gateway in the list.

  As clients of HQ the assessment of the entry door that only once, it is recommended to test for a stable connection.

  More information:

  Select operation optimal gateway AnyConnect

  Please let me know if that answers your question.

  Thanx.

  Portu

• AnyConnect 4.2.00096 question

  I have a client who uses the Cisco Anyconnect Secure Mobility Client version 4.2.00096.  With earlier versions of the AnyConnect client, you could launch the Windows client and in the address bar, it would write the address of the last VPN you connected to (ex: vpn.contoso.com). With this current version, it seems that the history of address is not kept.  I can see why it would be a feature of security for some, but there are some customers who remember not maybe not a DNS name for the vpn tunnel, that they want to connect, and I know users would struggle if they were to remember an ip address for the VPN tunnel.

  Has anyone else noticed this or found a fix so that it can display the address of the last tunnel VPN to you connected?

  Hi Justin,

  This part of the customization is configured under the profile XML, specifically on the server list tab, see the link below for an example of configuration:

  https://supportforums.Cisco.com/document/12550601/AnyConnect-XML-settings

  You can also view the xml profile that is installed on the computer, it lies on the following folder:

  %ProgramData%\Cisco\Cisco AnyConnect secure mobility Client\Profile

  It may be useful

  -Randy-

• Cisco Anyconnect license upgrade Questions

  Hi all

  So, we currently have a pair of failover ASA 5515 - X running at one of our sites. This serves as a VPN gateway for our users. I am migrating users from the old Cisco VPN client to the newest Cisco Anyconnect client. I have work and installing anyconnect. Meanwhile, I discovered that process to take care of TLS 1.1 and using the Anyconnect client, you must use the most recent 4.0 Anyconnect client. To use this client, you must have something license called a "Anyconnect more" I think it was a recent change of return in 2014. We currently have the Anyconnect Essentials license installed on the ASA pair. I discovered that not only it a license upgrade available for upgrade Anyconnect positive of the battery, but the Anyconnect Plus license is subscription now. Boo Cisco. But that's another debate.

  I went ahead and reluctantly bought the upgrade license to upgrade Anyconnect positive of the battery. I am trying to understand however the affects of the installation of this license with respect to the current VPN functionality. Currently, we offer the following VPN options for our users:

  RA IPSEC (IKE v1via former customer)

  RA IPSEC (L2TP via the Windows client)

  SSL (Anyconnect 3.0)

  We also use tunneling IPSEC of P2P (IKEv1 PSK) between two sites to serve as a link of relief when our primary site-to-site link fails.

  If anyone knows what would be the effect on the current VPN functionality when installing my upgrade license? He turns off the older IPSEC IKEv1 feature? As I said I want to migrate to the newer platform users but still have need of the oldest customer work until this can be done. I have this in my current setup:

  WebVPN

  AnyConnect essentials

  What happens on this command when I apply the new license?

  Appreciate any help here. Thank you.

  Addition of the new activation key and the client configuration somehow 4.x will not affect the IKEv1, L2TP or VPN SSL. "AnyConnect essentials" rest a command active and valid

  It will give the ability to activate the advanced security features that require the 4.x client.

• Cisco AnyConnect VPN 2.5/3.1 Question

  Hello

  If we run AnyConnect version 2.5 on our firewall, users who installed the 3.1 client will be able to VPN in without having to download version 2.5?

  Thank you!

  Yes. Routers and firewalls will upgrade (default) AnyConnect clients when they connect, but won't downgrade a newer client. I ' have a number of routers AnyConnect 2.5 configured which can not be upgraded due to storage constraints and 3.1 connect to them without difficulty.

• Question of AnyConnect with Cisco ASA 5505

  I keep hitting my head against the wall on this one. Whenever I try to connect to the AnyConnect SSL VPN I get the following error

  "No address available for an SVC connection.

  Up and down, I checked that my VPN pool be present and assigned. I have removed/re-added it so many times. I use the SMDA to implement through the wizard. Any help please?

  Here is my config

  http://pastebin.com/ABvSpzUq

  It seems that you are falling into default group policy.  You must activate the tunnel-group-list under the webvpn that allows users to select the group to which they connect, or set the attributes of the user to force the user into the correct connection profile...

  activation of tunnel-group-list

  WebVPN

  tunnel-group-list activate

  Configuration of the user attributes:

  Chris mXB.dKavHoEa0gaC of encrypted password username

  username Chris attributes

  VPN-group-policy HBNS_AnyConnect

  value of group-lock HBNS_AnyConnect

  type of remote access service

  --

  Please do not forget to choose a good response and the rate

• Question about AnyConnect

  Hi all

  I currently have a public with a set of ip addresses ASA 5550, external interface of my ASA address is 66.45.12.12 and I have also a few configurations of site to site VPN with a few other offices with the address of the external interface. I would like to configure VPN AnyConnect, is it OK to install AnyConnect to use the same outside the IP 66.45.12.12 on the same ASA? Are there cons/pros who happen to do this?

  Thank you.

  This isn't a problem at all. It's a very common way to implement.

  AnyConnect client will use the tcp 443 port (assuming SSL VPN) while the VPN site-to-site will continue to use the Protocol IP 51 and 50 (AH, ESP) and ISAKMP IKE, etc.

• Question about the license of Cisco's AnyConnect Mobile

  Hello

  I was reading on anycconnect, and I have a doubt,

  Do I need Cisco AnyConnect mobile license if I establish a vpn with the ASA windows desktop using the anyconnect client?.

  or these licenses are needed only when I use anyconnect on mobile platforms (iphone, ipad, Android)?

  hope someone clarify this point for me,

  Kind regards

  Juan Pablo Hidalgo

  It is useless to AnyConnect Mobile licenses for users who connect from a Windows desktop computer. These permits are only required for users with mobile platforms.

• iPad, AnyConnect Mobile license question

  Hello

  I'll put up an ASA5505 allow a VPN with the certificate of the Client AnyConnect Secure Mobility Client (iPad)

  However I get a message 'not of License"return of the ASA on the iPad - Anyconnect.

  I remember reading that the ASA5505 came with two licenses. Or am I wrong?

  Thank you for your help

  Edward

  No, the mobile AnyConnect license allow only ASA accept the SSL of the mobile client connection.

  If you want to use the certificate as authentication, then you will need to purchase the certificate from a CA. OR, you can configure the ASA as the CA server and it can produce certificate for the client.

  Alternatively, if you require a certificate, such as authentication, then CA certificate is not necessary at all.

• Error: "connection attempt timed out, please check the connectivity of the internet" when trying to connect to Cisco AnyConnect 2.5 on Windows 7 x 64 computer with modem usb wireless HSIA.

  Original title: issue with Cisco AnyConnect 2.5 on win 7 x 64 when connecting to the internet using wireless HSIA usb modem.

  I have win 7 x 64 enterprize edition on my laptop.

  I have problems with Cisco anyconnect VPN client. When I'm on my corporate network it works fine.

  But when I connect to internet using HSIA modem usb wireless home form, client AnyConnect VPN will not connect. The error I get is "connection attempt has expired, please check internet connectivity.

  Please help me to solve this problem as soon as possible.

  Hi Manish,

  The question you posted would be better suited in the TechNet Forums. I would recommend posting your query in the TechNet forums for assistance.

  I also recommend that you contact the VPN support to help:

  https://supportforums.Cisco.com/community/NetPro/security/VPN

• Cisco AnyConnect disabled after the installation of update KB3092627

  After the execution of automatic updates on 03/10/15, AnyConnect would not start and was not in my system tray. I uninstalled the update (KB3092627) and the returned icon and am now able to use Cisco AnyConnect. Anyone know if there is a specific problem here and I need the update?

  Hello

  Thanks for posting your query in Microsoft Community.

  Your question is beyond the scope of what is generally answered in this forum of consumer and would be better suited for the IT Pro TechNet public.

  Please post your question in the TechNet Forums.

• AnyConnect Session Timeout issue

  We have some remote users that are not happy with the SSL Connect connection down after close their laptops or lose their wireless for once. I read this question and answer of a Cisco page and I was wondering where the session time-out setting is changed. It's on the network client, software map AnyConnect or ASA firewall?

  Thank you, Pat.

  Q. What is the AnyConnect reconnect behavior?

  A. AnyConnect will attempt to reconnect if the connection is interrupted. This behavior is not configurable and auto. As long as the session on the SAA is still valid, the session will resume if AnyConnect can restore the physical connection.

  Version 2.2 includes a roaming feature that allows AnyConnect reconnect after a sleep of PC. The client will continue to try indefinitely until the head told him he can't reconnect and the client will not immediately RIP into the tunnel when the system goes Standby/Hibernate implementation. For customers who don't want this feature, set the session timeout value low to prevent sleep or resume reconnects.

  And also, for the new AnyConnect profile changes take effect, you will need to reconnect your AnyConnect session if the new policy is pushed to the client.