Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Register or Sign in
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
About Scotsdave
Scotsdave
Just browsing
Member since Jan 18, 2024
Jan 22 2024
Community Record
8
Posts
0
Kudos
0
Solutions
Badges
Jan 22 2024
7:14 AM
@alemabrahao thanks for helping with this. I have got it working. Reboot seems to be key to this once the xml files have been deployed unless its a fresh install. Copy preferences.xml and preferences_global.xml from a new machine after you have disabled captive portal detection. Do not connect to the vpn on your new machine or it will store your credentials as the defaults via the xml files. Your xml files should have the following line in them <DisableCaptivePortalDetection>true</DisableCaptivePortalDetection> I'm using the following script to deploy the software via intune incase it helps anyone in the future. Detection method is the MSI product code. #Starts installation of components and waits for completion
Start-Process msiexec.exe -ArgumentList "/i core.msi /qn /norestart" -Wait
Start-Process msiexec.exe -ArgumentList "/i sbl.msi /qn /norestart" -Wait
#Copies VPN Profile to local machine
Copy-Item .\Profile.xml -Destination "c:\ProgramData\Cisco\Cisco Secure Client\VPN\Profile" -force
Copy-Item .\preferences_global.xml -Destination "c:\ProgramData\Cisco\Cisco Secure Client\VPN" -force
#delete preferences file for vpn for local user profiles
$paths = Get-ChildItem -Directory c:\users | Select-Object $_.Name
ForEach ($path in $paths){
If (test-path "c:\users\$path\AppData\Local\Cisco\Cisco Secure Client\VPN\Preferences.xml")
{
Remove-Item -Path "c:\users\$path\AppData\Local\Cisco\Cisco Secure Client\VPN\Preferences.xml" -Force
Copy-Item .\preferences.xml -Destination "c:\users\$path\AppData\Local\Cisco\Cisco Secure Client\VPN\" -force
}
}
... View more
Jan 18 2024
6:24 AM
~Thanks for taking the time to look at it. I'll try sending those files with the package and see what happens on my test machine.
... View more
Jan 18 2024
5:39 AM
I edited this file as per my original post. It does enable the tick in the client. but it doesn't actually work. Thanks for your help though.
... View more
Jan 18 2024
5:23 AM
It doesn't change the Profile xml when changed this way. It does change the Globalpreferences.xml and the Preferences.xml Changing these xmls manually outside the VPN Client gui ticks the box to disable but doesn't actually take effect. So it looks like its disabled but the client still complains about a captive portal.
... View more
Jan 18 2024
5:12 AM
Yes as a troubleshooting task I disabled it. When doing it from the VPN Preferences it works and detects trusted network fine. But I need to automate it as I'm pushing this out to 200 devices.
... View more
Jan 18 2024
4:42 AM
Hi, Yes I've read the page I've looked at it several times before posting. I generated the XML file using the Cisco VPN Profile tool. So I have not free hand edited the document. It discusses the Certificate being wrong in the ASA and to check it. The Certificate in the MX is generated by the Meraki dashboard for the DDNS name assigned so I can't check or edit that. The behaviour is only happening on the network that hosts the VPN. I can avoid the behaviour if I can get the xml to disable the captive portal detection as ticking the boxes manually works. The VPN profile tool is also a checkbox exercise to generate the xml so its pretty fool proof. I have found many other people with the same issue which seems to be fixed by pushing the profile from the MX but I'd rather it worked from Day 1 before connecting. Which part do you think i've missed?
... View more
Jan 18 2024
3:34 AM
Thanks for the reply. The path you have posted is where I have been pushing the XML to. This is happening on clean machine with nothing else installed except the VPN client. So I can't see anything in the registry affecting it. Unless there are registry settings for the Anyconnect Client.
... View more
Jan 18 2024
12:45 AM
Hi guys I hope you can help, I've been spending weeks looking at this and pulling my hair out it seems to be fairly common issue with nobody really saying what they did to fix it. The issue I'm having is with clients that are inside the network behind the MX hosting the Anyconnect VPN Server. They are getting a warning about being behind a captive portal. I have disabled captive portal detection and disabled it being user configurable. <DisableCaptivePortalDetection UserControllable="true">true</DisableCaptivePortalDetection> using the VPN profile editor tool and configured trusted network with DNS suffix and DNS servers or either (multiple profiles to test effect). I can see in the DART logs the following:- VPN STATE : Disconnected Network State: Web Authentication Required Network control state: Network Access: Available Network Type: Trusted. I'm pushing the Anyconnect client with Intune, using a powershell script to install the MSI's and copy the Profile.xml to C:\ProgramData\Cisco\Cisco Secure Client\VPN\Profile. This is only installed on Windows 11 machines and we are using the 5.1.0.136 Anyconnect client. After Installation I can see that the option to toggle captive portal detection is still user configurable and is not ticked. If I tick it manually it disables and shows the Trusted Network symbol in the GUI. So it seems I am missing an XML configuration or registry setting somewhere. I have edited the following XML files that have the captive portal option. C:\ProgramData\Cisco\Cisco Secure Client\VPN\Profile\Profile.xml C:\ProgramData\Cisco\Cisco Secure Client\VPN\preferences_global.xml C:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client\Profile\preferences.xml C:\Users\%username%\AppData\Local\Cisco\Cisco Secure Client\VPN\preferences.xml If I set the files to disable captive portal true then the tick box does change in the GUI but the client doesn't do it. Meraki support so far have been unable to help and have directed me to Cisco for support but not sure how I go about doing that when all my licensing is with Meraki for support. Thanks for your help. David
... View more
Labels:
- Labels:
-
Client VPN
© 2024 Cisco Systems, Inc.
