Cisco Anyconnect Browser

Posted By admin  On 30.04.21



When you are off campus, some of Illinois State University’s electronic services are unavailable to you unless you establish a VPN connection.

Cisco AnyConnect is an application that the University makes available to students, faculty, and staff for free which may be used to establish a VPN connection with the University from off campus.

Solved: Hi everybody, I am configuring WebVPN on Cisco Router 3925e with Certificate and AAA authentication. Versions of software I use: C3925e = c3900e-universalk9-mz.SPA.152-4.M5.bin AnyConnect = anyconnect-win-3.1.05170 OS = Windows 7 SP1. The Cisco AnyConnect embedded browser gives us no way to log him out of JOHNSMITH@VENDOR.COM, and the Azure SAML page gives us no way to switch accounts. Since I am god awful at explanations, here is a link to someone else having pretty much the same issue but with Pulse instead of Cisco AnyConnect.

NOTE: If you need to request and install the application on your computer, please skip to the section further below entitled Download and Install Cisco AnyConnect. If you already have the application installed and would like to know how to connect to it, please read the section immediately below entitled Connect to the Cisco AnyConnect VPN Client Once Downloaded. The instructions below are listed for both Windows and Mac machines, respectively.

Connect to the Cisco AnyConnect VPN Client Once Downloaded

Windows:

  1. Open the Cisco AnyConnect VPN client.
  • Windows 8: On the Start screen, click Cisco AnyConnect Secure Mobility Client.
  • Windows 10: Start > All Apps > Cisco > Cisco AnyConnect Secure Mobility Client.
  • Alternatively, you can click Start and begin typing Cisco AnyConnect Secure Mobility Client and the application will show up. Click on the icon to start the application.
  1. Verify that the path in the field underneath “Ready to connect.” is VPN01.ILSTU.EDU.
  • If the path name does not automatically appear, click the arrow to the right of the field and select VPN01.ILSTU.EDU from the drop down menu, or enter the path name manually.
  1. Click Connect.

Figure 1:

  1. When prompted, select the appropriate Group (Figure 1):
  • To access most ISU resources, you will select –ISU-.
  • Important: To access ISU Oracle or SQL database resources directly (via software such as Microsoft Access, Oracle SQL Developer, Microsoft SQL Management Studio, etc.), select DB-User_Access.

Note: When you attempt to connect, you may receive a prompt that tells you that Cisco AnyConnect is updating. Do not attempt to cancel this update, as this update will allow your VPN software to work.

Figure 2:

  1. Enter your ULID and password in the appropriate fields, then click OK.
  2. After a moment, an informational banner window will appear that typically says “Welcome to Illinois State University,” but could display a different, informational message.
  3. Click Accept.

You are now connected with the Cisco AnyConnect VPN client. A Cisco AnyConnecticon with a yellow, locked padlock will be visible in your system tray (in the lower-right corner of your desktop, next to the clock). This indicates that you are connected. If the icon appears without a padlock, this indicates you are no longer connected through VPN.

Mac OS X:

  1. Open the Cisco AnyConnect VPN client. Click Finder > Applications> Cisco > Cisco AnyConnect Secure Mobility Client.

Figure 3:

  • Alternatively, you can search for the application in your “Dashboard” by simply clicking the rocket icon on your bottom toolbar. After that, start typing Cisco AnyConnect Secure Mobility Client and you will see the application. Click on the application to start the set-up process, or to access it once you’ve configured the settings properly.

Figure 4:

  1. Verify that the path in the field underneath “Ready to connect.” reads VPN01.ILSTU.EDU. If the field is empty, you will need to manually enter the file path exactly how it is shown in this article.

Figure 5:

  1. Click Connect.
  2. When prompted, select the appropriate Group (Figure 6):
  • For most ISU resources, you will select –ISU-.
  • Important: To access ISU Oracle or SQL database resources directly (via software such as Microsoft Access, Oracle SQL Developer, Microsoft SQL Management Studio, etc.), select DB-User_Access.

Figure 6:

  1. Enter your ULID and password when prompted to do so and click Connect.
  2. After a moment, an informational banner window will appear that typically says “Welcome to Illinois State University,” but could display a different, informational message.
  3. Click Accept.

You are now connected with the Cisco AnyConnect VPN client. A Cisco AnyConnect icon with a yellow, locked padlock is now in your system tray (in the lower-right corner of your desktop). This indicates that you are connected. If the icon appears without a padlock, this indicates you are no longer connected through VPN.

Cisco Anyconnect Browser

Disconnect from the VPN

Windows:

To disconnect from the VPN on a Window’s machine:

  1. Locate the Cisco AnyConnect VPN client icon and click on it. It is usually on your toolbar, but if it is not, here are some additional ways to find the application:
  • Windows 8: On the Start screen, click Cisco AnyConnect Secure Mobility Client.
  • Windows 10: Start > All Apps > Cisco > Cisco AnyConnect.
    • Alternatively, you can click [Start] and begin typing Cisco AnyConnect Secure Mobility Client and the application will show up. Click on the icon to start the application so you can disconnect from the VPN.
  1. In the Cisco AnyConnect Secure Mobility Client pane, click Disconnect.

Figure 7:

  1. Close Cisco AnyConnect Secure Mobility Client.

You are now disconnected from VPN.

Mac OSX:

To disconnect from a VPN connection on Cisco AnyConnect on Mac running Mac OS X or later:

  1. Click on the Cisco AnyConnect icon in your Dock.
  2. Click Disconnect.
  3. Close Cisco AnyConnect Secure Mobility Client.

Figure 8:

You are now disconnected from VPN.

Download and Install Cisco AnyConnect for Windows or Mac OS X

Students, faculty, and staff may download the Cisco AnyConnect VPN Client for Windows or Mac OS X from the University IT Help portal by following the directions below:

Windows:

  1. Navigate to the IT Help portal (at ITHelp.IllinoisState.edu),
  2. Click Downloads in the middle of the screen.
  3. Under Cisco AnyConnect, select the version you would like to download. You will need to select the version that is compatible with your machine. You can choose either Windows or Mac.
  4. Click on Windows or Mac and log in with your ULID and password if prompted to do so. You will be directed to a form to request the download file be sent to you. You will need to fill out the required fields in the submission form. Once submitted, your request will be handled in the order it was received. Once approved, you will receive an email. You will then click Download Files and you may be navigated to a Central Login page where you will need to enter your ULID and password. Once you log in, click the file next to Attached Files.

NOTE: If you have never access Liquid Files (SendTo) before, you may see a log in page to log into Liquid Files itself. Instead, you will want to click the SSO Sign In button to be navigated to a Central Login page. You will enter your ULID and password. Upon logging in, you will need to accept some terms and conditions. Once you have done that, you will never be prompted again for an SSO sign in.

  • Upon successfully downloading the installer, you will need to open the installer and follow the prompts.

Figure 9:

  • Agree to the Terms and Conditions and proceed with the installation by clicking Accept. You may need to enter your computer’s profile credentials in order to accept the installation.

Figure 10:

  • Once the software has finished downloading, click Finish to close out of the installation process. You can now access the VPN software.

Mac OS X:

  1. Navigate to the IT Help portal (at ITHelp.IllinoisState.edu),
  2. Click Downloads in the middle of the screen.
  3. Under Cisco AnyConnect, select the version you would like to download. You will need to select the version that is compatible with your machine. You can choose either Windows or Mac.
  4. Click on Windows or Mac and log in with your ULID and password if prompted to do so. You will be directed to a form to request the download file be sent to you. You will need to fill out the required fields in the submission form. Once submitted, your request will be handled in the order it was received. Once approved, you will receive an email. You will then click Download Files and you may be navigated to a Central Login page where you will need to enter your ULID and password. Once you log in, click the file next to Attached Files.

NOTE: If you have never access Liquid Files (SendTo) before, you may see a log in page to log into Liquid Files itself. Instead, you will want to click the SSO Sign In button to be navigated to a Central Login page. You will enter your ULID and password. Upon logging in, you will need to accept some terms and conditions. Once you have done that, you will never be prompted again for an SSO sign in.

  • Upon successfully downloading the installer, you will need to open the installer and follow the prompts. When you get to the Installation Type screen, ensure that only the VPN checkbox is selected, then click Continue to proceed with the installation
Anyconnect

Figure 11:

  • Click Continue to finish the installation. Once finished, open the Cisco AnyConnect Secure Mobility Client. You can find it in the Cisco folder in your applications, or can be manually searched in your Launchpad, as instructed above.

Figure 12:

  • Type VPN01.ILSTU.EDU in the empty text field, then press Connect.

Figure 13:

  • Enter your ULID in the Username field and your current password in the Password field. Click OK.

Figure 14:

  • You will see a welcome window. Click Accept to be connected to the VPN.

Figure 15:

  • Now that you are connected, you will be able to access university-restricted applications such as iPeople.
  • When you are ready to disconnect from the VPN, go back to the application and click Disconnect and close out of the application.

Figure 16:

How to Get Help

For technical assistance, you may contact the Technology Support Center at 309-438-4357 or by email at SupportCenter@IllinoisState.edu.

Back to Overview:

Related Articles:

Introduction

Cisco Anyconnect Browser

Cisco anyconnect browser install

This document describes the Cisco AnyConnect Mobility Client captive portal detection feature and the requirements for it to function correctly. Many wireless hotspots at hotels, restaurants, airports, and other public places use captive portals in order to block user access to the Internet. They redirect HTTP requests to their own websites that require users to enter their credentials or acknowledge terms and conditions of the hotspot host.

Prerequisites

Requirements

Cisco recommends that you have knowledge of the Cisco AnyConnect Secure Mobility Client.

Components Used

The information in this document is based on these software versions:

  • AnyConnect Version 3.1.04072
  • Cisco Adaptive Security Appliance (ASA) Version 9.1.2

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, make sure that you understand the potential impact of any command.

Background Information

Many facilities that offer Wi-Fi and wired access, such as airports, coffee shops, and hotels, require users to pay before they obtain access, agree to abide by an acceptable use policy, or both. These facilities use a technique called captive portal in order to prevent applications from connecting until users open a browser and accept the conditions for access.

Captive Portal Remediation Requirements

Support for both captive portal detection and remediation requires one of these licenses:

  • AnyConnect Premium (Secure Sockets Layer (SSL) VPN Edition)
  • Cisco AnyConnect Secure Mobility

You can use a Cisco AnyConnect Secure Mobility license in order to provide support for captive portal detection and remediation in combination with either an AnyConnect Essentials or an AnyConnect Premium license.

Cisco Anyconnect Browser Not Using Vpn

Note: Captive portal detection and remediation is supported on the Microsoft Windows and Macintosh OS X operating systems supported by the release of AnyConnect that is in use.

Captive Portal Hotspot Detection

AnyConnect displays the Unable to contact VPN server message on the GUI if it cannot connect, regardless of the cause. The VPN server specifies the secure gateway. If Always-on is enabled and a captive portal is not present, the client continues to attempt to connect to the VPN and updates the status message accordingly.

If the Always-on VPN is enabled, the connect failure policy is closed, captive portal remediation is disabled, and AnyConnect detects the presence of a captive portal, then the AnyConnect GUI displays this message once per connection and once per reconnect:

If AnyConnect detects the presence of a captive portal and the AnyConnect configuration differs from that previously described, the AnyConnect GUI displays this message once per connection and once per reconnect:

Caution: Captive portal detection is enabled by default and is nonconfigurable. AnyConnect does not modify any browser configuration settings during captive portal detection.

Captive Portal Hotspot Remediation

Captive portal remediation is the process where you satisfy the requirements of a captive portal hotspot in order to obtain network access.

AnyConnect does not remediate the captive portal; it relies on the end user to perform the remediation.

In order to perform the captive portal remediation, the end user meets the requirements of the hotspot provider. These requirements might include payment of a fee to access the network, a signature on an acceptable use policy, both, or some other requirement that is defined by the provider.

Captive portal remediation must be explicitly allowed in an AnyConnect VPN Client profile if AnyConnect Always-on is enabled and the Connect failure policy is set to Closed. If Always-on is enabled and the Connect Failure policy is set to Open, you do not need to explicitly allow captive portal remediation in an AnyConnect VPN Client profile because the user is not restricted from network access.

False Captive Portal Detection

AnyConnect can falsely assume it is in a captive portal in these situations.

  • If AnyConnect attempts to contact an ASA with a certificate that contains an incorrect server name (CN), then the AnyConnect client will think it is in a captive portal environment.
    In order to prevent this issue, make sure that the ASA certificate is properly configured. The CN value in the certificate must match the name of the ASA server in the VPN client profile.
  • If there is another device on the network before the ASA that responds to the client's attempt to contact an ASA by blocking HTTPS access to the ASA, then the AnyConnect client will think it is in a captive portal environment. This situation can occur when a user is on an internal network and connects through a firewall in order to connect to the ASA.
    If you must restrict access to the ASA from inside the corporation, configure your firewall such that HTTP and HTTPS traffic to the ASA's address does not return an HTTP status. HTTP/HTTPS access to the ASA should either be allowed or completely blocked (also known as black-holed) in order to ensure that HTTP/HTTPS requests sent to the ASA will not return an unexpected response.

AnyConnect Behavior

This section describes how the AnyConnect behaves.

Cisco Anyconnect Extension

  1. AnyConnect tries an HTTPS probe to the Fully Qualified Domain Name (FQDN) defined in the XML profile.
  2. If there is a certificate error (not trusted/wrong FQDN), then AnyConnect tries an HTTP probe to the FQDN defined in the XML profile. If there is any other response than an HTTP 302, then it considers itself to be behind a captive portal.

Captive Portal Incorrectly Detected with IKEV2

When you attempt an Internet Key Exchange Version 2 (IKEv2) connection to an ASA with SSL authentication disabled that runs the Adaptive Security Device Manager (ASDM) portal on port 443, the HTTPS probe performed for captive portal detection results in a redirect to the ASDM portal (/admin/public/index.html). Since this is not expected by the client, it looks like a captive portal redirect, and the connection attempt is prevented since it seems that captive portal remediation is required.

Cisco Anyconnect Web

Workarounds

If you encounter this issue, here are some workarounds:

  • Remove HTTP commands on that interface so that the ASA will not listen to HTTP connections on the interface.
  • Remove the SSL trustpoint on the interface.
  • Enable IKEV2 client-services.
  • Enable WebVPN on the interface.

This issue is resolved by Cisco bug ID CSCud17825 in Version 3.1(3103).

Caution: The same problem exists for Cisco IOS® routers. If ip http server is enabled on Cisco IOS, which is required if the same box is used as the PKI Server, AnyConnect falsely detects captive portal. The workaround is to use ip http access-class in order to stop responses to AnyConnect HTTP requests, instead of requesting authentication.

Cisco Anyconnect Browser Dns Error

Disable the Captive Portal Feature

Download Cisco Anyconnect

It is possible to disable the captive portal feature in AnyConnect client version 4.2.00096 and later (see Cisco bug ID CSCud97386). The administrator can determine if the option should be user configurable or disabled. This option is available under the Preferences (Part 1) section in the profile editor. The administrator can choose Disable Captive Portal Detection or User Controllable as shown in this profile editor snapshot:

If User controllable is checked, the checkbox appears on the Preferences tab of the AnyConnect Secure Mobility Client UI as shown here: