- Problem: On Windows with "Routing and Remote Access" (RRAS) service active,
Internet connection sharing (ICS) or dial _IN_ modem AnyConnect will display a
messagebox alerting that RRAS is active and will refuse to connect.
Resolution: Temporary solution - stop the RRAS service. Permanent solution -
switch the service to "manual" from automatic, disable ICS, if dial-in
services are active (very rare) remove them too.
- Problem: AnyConnect will refuse to work when the computer is being
remote-controlled. No workaround, it should be this way.
- Problem: AnyConnect will refuse to work when the computer has multiple local
users logged in concurrently using "Fast User Switching". No workaround, it
should be this way.
- Problem: When authenticating the Cisco AnyConnect it preforms automatic update and
fails to connect. It does so every time it's started.
Un-installation and re-installation does not help.
Resolution: Uninstall "embassy trust suite by wave systems", especially on Dell computers.
Note - the same programs causes many problems in conjunction with McAfee
- Problem: AnyConnect complains about certificate errors, When attempting to connect
generates an error message saying "The VPN client is unable to establish a
Cause: SSL proxy that does content inspection/ problems with local CA
certificates/ man-in-the-middle on SSL connection. All these can cause
1. verify that the certificate for the CA that signs Samba's certificate
(currently "Equifax Secure Certificate Authority") exists in the computer's
certificate store and is valid (SHA1 thumbprint for the Equifax CA should be
"d2 32 09 ad 23 d3 14 23 21 74 e4 0d 7f 9d 62 13 97
86 63 3a").
2. Make sure that no system wide proxy is set up (in windows it is defined
in Internet Explorer, Macs set it up in the "Network" control panel).
3. In the rare case that a content inspecting proxy must be used (usually
_very_ secure networks) the network system administrator should sort the
certificate mess. Sys admins is such places will probably reject entirely the
idea that VPN can be used to get out of their net.
- Problem: Computers running Mac OS or Linux connected to the internet by PPTP
or L2TP fail to connect to Samba. The authentication is successful but no data
passes on the VPN (connection statistics show only 768 bytes received).
Anyconnect either disconnect immediately or within two minutes. In Linux the
Internet connection is dropped too.
Cause: When AnyConnect establishes the VPN link it has to rearrange the
routing table so that all traffic will be routed through it. It fails to keep
the route to the PPP peer (the ISP's dial in address) alive.
1. If possible - switch to PPPoE to establish the Internet connection.
It is easy to do so in the dorms (or public ports) and more difficult in aDSL
as it usually requires modification to modem setup. HOT do not enable PPPoE.
2. Linux users can manually exclude the PPP peer from the VPN. Macs can't
yet but it should be fixed in a few months. the instructions for the PPP
exclusion appear in the AnyConnect release notes, the easiest solution is to
tell the users to talk to me so I'll send them a ~/.anyconnect file with the
1. It will be better in future AnyConnect releases (PPP peer will be auto
detected like it is on Windows systems).
2. Computers connected via a router are not affected by this issue even if
the router uses PPTP or L2TP to connect to the internet.
- Problem: Samba WebVPN (not AnyConnect) shows some sites incorrectly, with some
content missing or scripts not working properly.
1. We can ask Cisco for fixes for specific sites. We are still learning
how it is done exactly. Notify Simon, Alex or me of the site.
2. If the site is within HUJI - fix is since it is probably written poorly
(badly written scripts, or the site relies heavily on flashy stuff such as
Note: The site repair is mainly intended towards sites that hold academic data,
e-journals and sites that are only accessible from HUJI net. We already asked
the librarians for a list of problematic sites.
Note (2): We already know that flash on www.huji.ac.il is not working or
that ynet takes ages to load. Read previous note again.