Skip to main content
Question

Cisco AnyConnect broken after update to Monterey 12.3

  • March 24, 2022
  • 14 replies
  • 89 views
K
Forum|alt.badge.img+3

Hi everyone,

we are using Cisco AnyConnect with MFA for our VPN, this worked fine until the upgrade to Monterey 12.3

All the Users who upgraded now get this error "Authentication failed due to problem verifying server certificate."

I already opened a Call with Cisco but that didn't help a thing. With my basic Wireshark knowledge I found the error of Handshake failure (comparing 12.2.1 and 12.3. connection tries) 

Did Apple block or discontinue any Ciphers or anything ? Anyone else seen this Issue ?

Thanks for your input or ideas.

    14 replies

    V
    Forum|alt.badge.img+4
    • vagabon
    • New Contributor
    • March 24, 2022

    I'm on 12.3 and connecting fine (Cisco AnyConnect with MFA). What version of Cisco AnyConnect are you on? (I'm on 4.10.04071)

    K
    Forum|alt.badge.img+3
    • kinnetik
    • Author
    • New Contributor
    • March 24, 2022

    We are using 4.10.05085

    mvu
    Forum|alt.badge.img+20
    • mvu
    • Jamf Heroes
    • March 24, 2022

    We are testing 12.3 with 4.10.04071 CiscoAny Connect with Smart Cards. No issues.

    K
    Forum|alt.badge.img+3
    • kinnetik
    • Author
    • New Contributor
    • March 24, 2022

    Hi mvu,

    SmartCard / Certificate on Dongle is no issue as well, its only the MFA which is troubling us. Unfortunately all Mac Users are using the MFA Gateway

    mvu
    Forum|alt.badge.img+20
    • mvu
    • Jamf Heroes
    • March 24, 2022

    Can you downgrade/test an earlier version?

    K
    Forum|alt.badge.img+3
    • kinnetik
    • Author
    • New Contributor
    • March 24, 2022

    As I mentioned this behaviour is only seen after upgrading to 12.3, on 12.2.1. everything works normal with MFA.

    But since there is no way to rollback the already upgraded Macs its not a solution.

    V
    Forum|alt.badge.img+4
    • vagabon
    • New Contributor
    • March 24, 2022

    I think what we are curious about is what happens if you try 4071 and 12.3. Are you able to try using 4071 version of AnyConnect?

    K
    Forum|alt.badge.img+3
    • kinnetik
    • Author
    • New Contributor
    • March 24, 2022

    Ah, sorry my mistake. I just uninstalled 5085 and tried with 4071 after a reboot. Same issue.

    I will try to talk to our VPN guys, looking more into the network trace I found out that 12.3 is only offering 22 Ciphersuites to the Gateway compared to 27 in 12.2.1 maybe they need to enable sth. 

    Just strange that Cisco says they don't see anything in the gateway logs.

    mvu
    Forum|alt.badge.img+20
    • mvu
    • Jamf Heroes
    • March 24, 2022

    Do you have Apple Enterprise support? Maybe worth a ticket that way so they're aware of a possible 12.3 issue.

    K
    Forum|alt.badge.img+3
    • kinnetik
    • Author
    • New Contributor
    • March 25, 2022

    Ok, it was a misconfiguration on the VPN Gateway, we now added one of the 22 Ciphers Apple is using and its working again.

    dgeiler
    Forum|alt.badge.img+7
    • dgeiler
    • Contributor
    • May 5, 2022

    We have downloaded the newest Version 4.10.05085 and is working fine. Have your network admin login and download it for you

    L
    Forum|alt.badge.img+1
    • LakotaTo
    • New Contributor
    • May 13, 2022

    Ok, it was a misconfiguration on the VPN Gateway, we now added one of the 22 Ciphers Apple is using and its working again.


    Hello Kinnetik, plis can you share the solution?. I have been looking for a solution for days and have not found it yet. I am on OS 12.13.1 and AnyConnect client For mac 4.10.05095

    K
    Forum|alt.badge.img+3
    • kinnetik
    • Author
    • New Contributor
    • May 13, 2022

    Hello Kinnetik, plis can you share the solution?. I have been looking for a solution for days and have not found it yet. I am on OS 12.13.1 and AnyConnect client For mac 4.10.05095


    We had to add AES256-GCM-SHA384 to the allowed cipehers on the Cisco VPN Gateway, now its working again.

    L
    Forum|alt.badge.img+1
    • LakotaTo
    • New Contributor
    • May 16, 2022

    We had to add AES256-GCM-SHA384 to the allowed cipehers on the Cisco VPN Gateway, now its working again.


    Please Kinnetik, can you tell me how you added it?

    Terms & ConditionsCookie settingsAccessibility statement