Cisco Anyconnect Debug

02-05-2021 by



See full list on cisco.com. Apr 15, 2021 Locate the Cisco AnyConnect VPN Client in the Applications and Services Logs (of Windows 7) and choose Save Log File As. Assign a filename, for example, AnyConnectClientLog.evt. You must use the.evt file format. Modify the Windows Diagnostic Debug Utility. How can I debug Cisco Anyconnect constantly connecting and reconnecting?uninstall cisco vpn client (anyconnect)How do I install the Cisco Anyconnect VPN client?Cisco Anyconnect flashes then disappearsCisco vpn AnyConnect freezesWired Connection problem on Ubuntu 14.10Failed to connect to Cisco anyconnect VPN via openconnectCisco AnyConnect Second Password option17.10 cisco anyconnect vpn.

AnyConnect VPN Monitoring Debugging. Hi Adding to what Ciscomax said try ' debug webvpn anyconnect 255' and 'debug webvpn 255' if you are using ASA 8.3 and above. If you are using 8.2 or below use 'debug webvpn 255' and 'debug webvp svc 255' If possible send me the output of sh run all SSL.

As wireless networks have evolved in the past years it is getting harder and harder to troubleshoot advanced environments where there are a lot of different key players involved: you got the APs and their WLC, the AAA-servers and the clients themselves to keep track of and try to sort out what is going on during times of trouble.

Cisco WLCs has a lot of useful debugging commands that can be run in CLI but trying to fully understand what is going on can be hard at times. Way too many debugging events are poorly “explained” as they fly by the command line and I often find myself having to look up weird messages and status codes afterwards.

Cisco Anyconnect Debug

Cisco themselves, being aware of this issue, has a tool published on their website called Wireless Debug Analyzer. It is listed as a tool used by the Cisco TAC to quickly parse through debug logs/output and making them more readable to the user. The idea is that you save the debugging log of a misbehaving wireless clientto a text file and then upload that text file to the tool’s website where it will be processed and “translated” into (hopefully) something better.

You can find the tool at https://cway.cisco.com/tools/WirelessDebugAnalyzer/ (Cisco login required)

According to the very short documentation, all you need to upload is a text file containing the debug ouput of the command debug client <mac-address>. There is also a short footnote about the tool also being able to read some of the debug output from the “debug aaa/mdns/webauth…” commands.

Parsing a successful 802.1X login (debug client <mac> only)

The first test was done using a debug client <mac-address> of a smartphone successfully connecting to an 802.1X SSID using PEAP-MSCHAPv2 and authentication method. The original debug output was around 400 rows of ouput and after putting it through the parser we ended up with this:

I’ve highlighted some of the intreresting messages where we can see that EAP-authentication takes place and is successful based on that the RADIUS server (ISE in this case) permits the access. What I would’ve loved to see here is what kind of access is given (VLAN assignment, ACL assigment or similar) but with this particular debug it’s as good as it’s gonna get using this tools, even if the original debug output tells us what kind of AAA Override took place (in my case I assigned a particular VLAN to the client).

Parsing a successful 802.1X login (debug client <mac> and aaa)

By adding debug aaa packets to the mix in addition to the debug client <mac-address> command, we do get a lot more debug output which gets translated by the tool when we upload the debug output text file.

This time we get to see which AAA-server (RADIUS) IP-address was used to authenticate this client device. For some reason, as you can see, a lot of RADIUS sessions were created during the authentication of this client device (Radius requests/challenges) but ultimately the authentication was successful and an Access-Accept packet was sent to the WLC. However, still no word on other attributes that could’ve been sent to the WLC such as VLAN assignment or ACL assignment.

Vpn - How Can I Debug Cisco Anyconnect Constantly Connecting ..

Parsing a failed 802.1X login (debug client <mac>)

Once again we are only running the debug client <mac-address> command but this time I will deliberatly fail the 802.1x authentication by typing in the wrong password.

Cisco Anyconnect Debug Dap

AnyConnect VPN Client FAQ

The information translated for us from this log is pretty weak, as you can see there isn’t much being said about the authentication at all and at the end of it we are not even being told the authentication failed, only that it WLC/AP asks the device again to identity itself.

Cisco Secure Desktop (CSD) FAQ

Parsing a failed 802.1X login (debug client <mac> and aaa)

Cisco ASA 5500 Series Adaptive Security Appliances

By adding debug aaa packets to the mix in addition to the debug client <mac-address> command, we do get a some more debug output but most of it is just repeat text telling us the WLC is resending the authentication to the AAA-server over and over again in new RADIUS sessions. Mozilla browser wikipedia. Free unzip program mac.

Verdict

See All Results For This Question

The Cisco Wireless Debug Analyzer isn’t as great as it could’ve been, I love the idea of this tool making troubleshooting simpler but it doesn’t seem advanced enough. If anything, it is useful at dividing the debug output into sections even if the “translated” result is not very well-described or not there at all. With the newer WLCs actually running Ciso’s own IOS-XE software instead of AireOS which has been used for the past 10 years or so, I don’t see Cisco putting any more effort into making this tool better, but I guess we have to keep in mind this tool was made by a couple of engineers at Cisco so maybe it can’t be considered a “real” product where users can demand new features. The tool is not very useful for troubleshooting failed AAA authentication attempts due to barebone information, it’s better to just look in the live logs of the AAA server if you are able to.

Cisco AnyConnect VPN Client

The tool doesn’t seem to be consistent with the information being translated, in some of the cases I was able to a translation of which IP-address was assigned to the client on a successful login, but as you can see above it never happened while I was grabbing these screenshots.





Backblaze B2 S3
Uf Citrix Workspace

Comments are closed.