Cisco anyconnect VPN - XML profiles not appearing in dropdown box

[Stewie]

Hello,

We are currently rolling out Cisco anyconnect VPN to replace the L2TP VPN my company has been using for years.

One of the last issues we are trying to resolve is getting the vpn profiles to work with the client, when the profile is downloaded from our MX68 appliance it works, and the dropdown box populates with multiple gateways. however the powers that be require the profiles to be set before our users connect to the VPN for the first time.

from the setup documentation (and other forum posts i've found from searching) the xml file should be placed in C:\programdata\cisco\cisco anyconnect secure mobility client\profile

however, after manually placing the .xml file in the profile folder it doesn't populate. I have restarted the services, rebooted, reinstalled, renamed the .xml, remade the file via the profile builder, but nothing I've tried so far has gotten this to work.

I have also tried placing the .xml file into the C:\programdata\cisco\cisco secure client\VPN\Profile without any luck as well.

we are using the default DDNS name that is generated by the MX68 meraki appliance.

meraki firmware is: MX 18.107.2

cisco secure client - Anyconnect VPN version is: 5.0.02075

I've tried this on multiple machines and OS, including Win10 pro, Ent,and win 11 pro.

any insight from the community that can point me in the right direction, as I'm stumped.

##EDIT: to anyone who stumbles on this in the future, the "Profile.xml" is case sensitive. If you attempt to use "profile.xml" for the cisco VPN client, it will not work. @alemabrahao had the solution dead on, this is just a reminder to double check the case of your file.

[alemabrahao · Accepted solution]

This configuration has nothing to do with the MX configuration, it is a local configuration in the workstation. Here is an example:

<?xml version="1.0" encoding="UTF-8"?>
<AnyConnectProfile xmlns="http://schemas.xmlsoap.org/encoding/">
<ServerList>
<HostEntry>
<User>Pandiyan</User>
<HostName>MyHost</HostName>
<HostAddress>local.pandiyan.com</HostAddress>
</HostEntry>
</ServerList>
<ServerList>
<HostEntry>
<User>Guest</User>
<HostName>MyGuest</HostName>
<HostAddress>guest.pandiyan.com</HostAddress>
</HostEntry>
</ServerList>
</AnyConnectProfile>

Save with name Profile.xml

[alemabrahao]

Save in this path: C:\ProgramData\Cisco\Cisco Secure Client\VPN\Profile

[Stewie]

I feel like an idiot for not realizing that.. makes total sense now, thank you for the help!

[Jamsession]

Hello, 

I'm trying to understand the solution here. I am currently having a similar issue. 

I have my xml profile packaged in win32 and deployed through intune to:

C:\programdata\cisco\cisco secure client\VPN\Profile

But even with the profile present the connect option does not appear.

My profile name is: Profileconfig.xml

Which is also uploaded to meraki for the profile update. It works if I input the host myself, but is blank before that. 

Here is my xml: 

<?xml version="1.0" encoding="UTF-8"?>
<AnyConnectPreferences>
<DefaultUser></DefaultUser>
<DefaultSecondUser></DefaultSecondUser>
<ClientCertificateThumbprint></ClientCertificateThumbprint>
<MultipleClientCertificateThumbprints></MultipleClientCertificateThumbprints>
<ServerCertificateThumbprint></ServerCertificateThumbprint>
<DefaultHostName>myhostname</DefaultHostName>
<DefaultHostAddress>myaddress</DefaultHostAddress>
<DefaultGroup></DefaultGroup>
<ProxyHost></ProxyHost>
<ProxyPort></ProxyPort>
<SDITokenType>none</SDITokenType>
<ControllablePreferences></ControllablePreferences>
</AnyConnectPreferences>

[alemabrahao]

Save with name Profile.xml in this path: C:\ProgramData\Cisco\Cisco Secure Client\VPN\Profile

[Jamsession]

EDIT RESOLVED!!!!- boy do i feel dumb. I wasn't making my changes as a administrator. 

I have no problems using Profile.xml as the profile, but still don't seem to get a ready connection on a profile that has yet to use anyconnect for the first time. 

It's weird because I have been scouring looking for info and what is provided is generally what I have / had done. 

@alemabrahao I used your exact profile format posted above thinking maybe its my file, but still the same result.

[alemabrahao]

The variables in your file are different, use exactly as I put them in the post.

<?xml version="1.0" encoding="UTF-8"?>
<AnyConnectProfile xmlns="http://schemas.xmlsoap.org/encoding/">
<ServerList>
<HostEntry>
<User>Pandiyan</User>
<HostName>MyHost</HostName>
<HostAddress>local.pandiyan.com</HostAddress>
</HostEntry>
</ServerList>
<ServerList>
<HostEntry>
<User>Guest</User>
<HostName>MyGuest</HostName>
<HostAddress>guest.pandiyan.com</HostAddress>
</HostEntry>
</ServerList>
</AnyConnectProfile>

[Jamsession]

That was it! 
Your file plus editing as a admin. 

Thank you sir!

[alemabrahao]

It's my pleasure.

[PhilipDAth]

Some other tips - I have written a tool for creating the profiles for you:
https://www.ifm.net.nz/cookbooks/online-anyconnect-profile-editor.html

When you upload the profile in the Meraki dashboard, it ALWAYS appends .XML when it is downloaded by AnyConnect.  So if you upload company.xml, it gets downloaded as company.xml.xml.  So I tend to upload the profiles without an extension.

Next, if you have another Cisco product, such as Cisco Umbrella, you get to use Cisco SecureX.  You can buy just a single licence for Cisco Umbrella (cheap) and not even use it, to get access to SecureX.

Why might you want to use Cisco SecureX?  Because it cloud manages AnyConnect.  You no longer use profiles - you control the settings in the Cisco SecureX dashboard.  You can automate software updates, create test profiles, etc.  Basically, this is the way you want to be rolling out new AnyConnect deployments.

All this for maybe $3/month (cost of an Umbrella licence), assuming you don't already own another Cisco security product.

Take a look at this thread where I show some of screenshots of what it looks like:
https://community.meraki.com/t5/Security-SD-WAN/Update-AnyConnect-clients-now/m-p/198950