VPN - Troubleshooting Cisco Secure Client

Overview

If you are having troubles downloading or connecting to the VPN using Cisco Secure Client (formerly Cisco AnyConnect), see the troubleshooting tips below. The first section, titled "General Troubleshooting," contains tips that will solve the most common errors. More details about the VPN and authenticating with Duo NetID Two-Factor Authentication can be found in our knowledge base.

General Troubleshooting

• Make sure you are using your NetID, NOT your UIN.
  • Your UIN may work on Howdy and other TAMU websites - but when using the VPN, you must use your NetID or it will not authenticate.
  • If you recently changed your NetID and are having troubles logging in, Help Desk Central may need to request that your new NetID is given the correct permissions to connect to the VPN. Please call them at (979) 845-8300.
• Make sure you are authenticating with Duo correctly.
  • The VPN uses push notifications by default, and it does not give you an indication that the push notification has been sent. Have your Duo app open whenever you login so you do not miss the authentication request.
  • If you do not have the Duo app or wish to authenticate another way, please go to our documentation on Using Two-Factor authentication with Cisco Secure Client and see the section titled "Different Methods of Duo Authentication."
• If you are getting a "Login Failed" message IMMEDIATELY after trying to sign in, you should perform a password flush. This means changing your password to the same thing it already is, which helps push the password across TAMU servers.
• If you are on a departmental computer and cannot complete the installation process because you need administrator privileges, you will need to contact your departmental IT.
• If you cannot resolve the problems with the Cisco Secure Client client, try connecting via L2TP instead.
• Troubleshooting for more specific errors can be found in the sections below. If you are unable to resolve your issue, please call Help Desk Central at (979) 845-8300 or make an appointment to visit them in the Computing Services Complex, CS00.

Rejected Connection Attempt

If you get the error message below, please wait 15 minutes and try to connect again:

The secure gateway has rejected the connection attempt. A new connection attempt to the same or another secure gateway is needed, which requires re-authentication. The following message was received from the secure gateway: Unable to setup connection.

This issue usually resolves itself. If you still cannot connect after trying again, please report the issue to Help Desk Central by calling (979) 845-8300.

Stuck on "Connecting"

If you have successfully entered your credentials but are stuck on a repeating "connecting" message without being prompted for Duo, there are two things you can try.

1. Run the repair tool on the desktop client.
   1. Visit connect.tamu.edu.
   2. Log in and download the client as if you were doing so for the first time.
   3. The installer should give you an option to repair the client instead of installing it.
2. Uninstall the client, then reinstall the it.
   1. On Macs, you can uninstall the client by dragging the application to your trash icon, then clearing out the trash.
   2. On Windows machines, you can uninstall the client by searching for the Add or Remove Programs menu in the Type here to search bar at the bottom of your screen
   3. To reinstall the client and connect to it, follow the directions in our document on connecting with Cisco Secure Client.

Operating System not Detected

When downloading the Cisco Secure Client client on a Mac, you may see the message "The installer is detecting your operating system and CPU, please wait..." for a very long time. This is a common occurrence on Macs while using Chrome. We recommend using Safari instead. You also need to make sure cookies are enabled in Safari. You can enable cookies with the directions below:

1. While the Safari browser is launched, click Safari in the top left corner of your screen.
2. Click Privacy.
3. Select Cookies and Website Data.
4. Select Allow from current website only. (You can also allow cookies for all websites, this is up to you).
5. Refresh the page.

Cisco Secure Client Says it is Already Installed

This error can happen on Macs if an installation is only half-complete, or if you are attempting to uninstall and reinstall the client.

Please read over ALL of the directions in this section before beginning to avoid wasting time.

To fix this error, launch Terminal and enter the following commands (type them exactly as they appear, and only enter one line at a time):

sudo -s
rm -rf /System/Library/StartupItems/CiscoVPN
rm -rf /Library/StartupItems/CiscoVPN
rm -rf /System/Library/Extensions/CiscoVPN.kext
rm -rf /Library/Extensions/CiscoVPN.kext
rm -rf /Library/Receipts/vpnclient-kext.pkg
rm -rf /Library/Receipts/vpnclient-startup.pkg
reboot

If you installed the Cisco VPN for Mac version 4.1.08005 package, enter these commands as well (after completing the commands and reboot in the section above):

sudo -s
rm -rf /Cisco\ VPN\ Client.mpkg
rm -rf /com.nexUmoja.Shimo.plist
rm -rf /Profiles
rm -rf /Shimo.app
exit

Alternatively, if you no longer need Cisco Secure Client at all, you can enter these commands:

sudo -s
rm -rf /Library/Application\ Support/Shimo
rm -rf /Library/Frameworks/cisco-vpnclient.framework
rm -rf /Library/Extensions/tun.kext
rm -rf /Library/Extensions/tap.kext
rm -rf /private/opt/cisco-vpnclient
rm -rf /Applications/VPNClient.app
rm -rf /Applications/Shimo.app
rm -rf /private/etc/opt/cisco-vpnclient
rm -rf /Library/Receipts/vpnclient-api.pkg
rm -rf /Library/Receipts/vpnclient-bin.pkg
rm -rf /Library/Receipts/vpnclient-gui.pkg
rm -rf /Library/Receipts/vpnclient-profiles.pkg
rm -rf ~/Library/Preferences/com.nexUmoja.Shimo.plist
rm -rf ~/Library/Application\ Support/Shimo
rm -rf ~/Library/Preferences/com.cisco.VPNClient.plist
rm -rf ~/Library/Application\ Support/SyncServices/Local/TFSM/com.
nexumoja.Shimo.Profiles
rm -rf ~/Library/Logs/Shimo*
rm -rf ~/Library/Application\ Support/Shimo
rm -rf ~/Library/Application\ Support/Growl/Tickets/Shimo.growlTicket
exit

Whichever of the above commands you enter, you MUST finish with the following last command:

sudo pkgutil --forget com.cisco.pkg.Secure Client.vpn

You can also try the above command on its own. Sometimes, this one command will resolve the problem. You can try just this one line first, then try reinstalling the client. If the installation still fails, you will need to get more complicated.

Remote Connection Interrupted

If you get the error message "The remote connection was interrupted" after a few minutes of using the VPN, we recommend setting up a connection via L2TP rather than using the client. Instructions for this can be found here.

Interprocess Communication Depot Error

If you are receiving the error message "The VPN client agent was unable to create the interprocess communication depot", you need to disable System Wide Internet Connection Sharing (ICS). You can do this by following the steps below:

1. Click the Start button.
2. Type: services.msc and press the Enter key on your keyboard.
3. Scroll down and double-click on Internet Connection Sharing (ICS).
4. Change Startup Type to Disabled.
5. Restart the computer.

If the above directions do not resolve your issue, you can also try the following directions:

1. Click the Start button.
2. Click on Control Panel.
3. Click on View Network Status and Tasks.
4. Click on Change Adapter Settings.
5. Right-click the shared connection and choose Properties.
6. Click the Sharing tab.
7. Clear the Allow other network users to connect through this computer's internet connection checkbox.
8. Click OK.

VPN establishment capability for a remote user is disabled

The error message "VPN establishment capability for a remote user is disabled" will usually be encountered in a situation where you are trying to establish a VPN connection for a remote device that you are controlling from another location. The ability to establish a VPN connection in this situation is disabled and not available for connections to the Texas A&M VPN server.