设置与 Cisco AnyConnect 的 VPN 连接 - 无法找到安全网关上的 AnyConnect 包

Question

我正在尝试通过 VPN 建立连接。我需要使用 Cisco AnyConnect。首先我收到错误Cerfitication validation error。然后我通过firefox添加了证书（.pfx格式）。然后当我尝试再次使用 AnyConnect 连接时，它让我输入用户名和密码。

我输入了用户名和密码，但是当我按下登录时，出现以下错误：

The AnyConnect package on the secure gateway could not be located. You may be experiencing network connectivity issues. Please try connecting again.

我也尝试过 OpenConnect，我设法与它连接（我收到成功连接的响应）。但是当我试图进入客户网站时，它只是开始加载，什么也没有发生。当我尝试 ping 客户端的网站时，它只返回 IP 一次并停止。

可能是什么原因？

PS 我的客户说使用 OpenConnect，可能不让看到网站，因为 OpenConnect 不知道我对他们的网站进行了什么样的访问。

通过 AnyConnect 连接时更新我的日志（anynimized 信息）：

Jun 18 16:55:39 user-Dell acvpnagent[1373]: Function: logInterfaces File: ../../vpn/AgentUtilities/Routing/InterfaceRouteMonitorCommon.cpp Line: 477 IP Address Interface List: 111.111.111.111 FE80:0:0:0:868F:69FF:FEBD:5983 
Jun 18 16:55:39 user-Dell dbus[691]: [system] Successfully activated service 'org.freedesktop.nm_dispatcher'
Jun 18 16:55:39 user-Dell avahi-daemon[799]: Withdrawing workstation service for vpn0.
Jun 18 16:55:39 user-Dell NetworkManager[1042]:    SCPlugin-Ifupdown: devices removed (path: /sys/devices/virtual/net/vpn0, iface: vpn0)
Jun 18 16:55:44 user-Dell NetworkManager[1042]: <info> VPN service 'openconnect' disappeared
Jun 18 16:55:58 user-Dell acvpnui[5515]: Initializing vpnapi version 3.1.03103 ().
Jun 18 16:55:58 user-Dell acvpnui[5515]: Function: loadProfiles File: ../../vpn/Api/ProfileMgr.cpp Line: 103 No profile is available.
Jun 18 16:55:58 user-Dell acvpnui[5515]: Function: getCurrentState File: ../../vpn/Api/ClientIfcBase.cpp Line: 2058 API service not ready
Jun 18 16:55:58 user-Dell acvpnui[5515]: Current Preference Settings: ServiceDisable: false CertificateStoreOverride: false CertificateStore: All ShowPreConnectMessage: false AutoConnectOnStart: false MinimizeOnConnect: true LocalLanAccess: false AutoReconnect: true AutoUpdate: true ProxySettings: Native AllowLocalProxyConnections: true PPPExclusion: Disable PPPExclusionServerIP:  EnableScripting: false TerminateScriptOnNextEvent: false AuthenticationTimeout: 12 IPProtocolSupport: IPv4,IPv6 AllowManualHostInput: true BlockUntrustedServers: false PublicProxyServerAddress:  
Jun 18 16:55:58 user-Dell acvpnui[5515]: Function: CvcGtkNotifyBalloon File: ../../../vpn/GUI/Linux/CvcGtkNotifyBalloon.cpp Line: 87 Invoked Function: dlopen Return Code: -33554427 (0xFE000005) Description: libnotify.so.1: cannot open shared object file: No such file or directory 
Jun 18 16:55:58 user-Dell acvpnui[5515]: Function: OnNegotiateMessageTypesComplete File: ../../vpn/Api/ApiIpc.cpp Line: 726 Master Agent Connection started.
Jun 18 16:55:59 user-Dell acvpnui[5515]: VPN state: Disconnected Network state: Network Accessible Network control state: Network Access: Available Network type: Undefined
Jun 18 16:55:59 user-Dell acvpnui[5515]: Function: setConnectRequestComplete File: ../../vpn/Api/ConnectMgr.cpp Line: 9127 Connect request complete. Proceeding to cleanup.
Jun 18 16:55:59 user-Dell acvpnui[5515]: Function: activateConnectEvent File: ../../vpn/Api/ConnectMgr.cpp Line: 1351 NULL object. Cannot establish a connection at this time.
Jun 18 16:55:59 user-Dell acvpnui[5515]: Message type information sent to the user: Ready to connect.
Jun 18 16:55:59 user-Dell acvpnui[5515]: Function: attach File: ../../vpn/Api/ClientIfcBase.cpp Line: 629 Client successfully attached.
Jun 18 16:56:00 user-Dell acvpnui[5515]: An SSL VPN connection to some_host has been requested by the user.
Jun 18 16:56:00 user-Dell acvpnui[5515]: Function: getProfileNameFromHost File: ../../vpn/Api/ProfileMgr.cpp Line: 796 No profile available for host some_host
Jun 18 16:56:00 user-Dell acvpnui[5515]: Function: getHostInitSettings File: ../../vpn/Api/ProfileMgr.cpp Line: 876 Profile () not found. Using default settings.
Jun 18 16:56:00 user-Dell acvpnui[5515]: Function: loadProfiles File: ../../vpn/Api/ProfileMgr.cpp Line: 103 No profile is available.
Jun 18 16:56:00 user-Dell acvpnui[5515]: Function: getProfileNameFromHost File: ../../vpn/Api/ProfileMgr.cpp Line: 796 No profile available for host some_host
Jun 18 16:56:00 user-Dell acvpnui[5515]: Using default preferences. Some settings (e.g. certificate matching) may not function as expected if a local profile is expected to be used. Verify that the selected host is in the server list section of the profile and that the profile is configured on the secure gateway.
Jun 18 16:56:00 user-Dell acvpnui[5515]: Function: getProfileNameFromHost File: ../../vpn/Api/ProfileMgr.cpp Line: 796 No profile available for host some_host.
Jun 18 16:56:00 user-Dell acvpnui[5515]: Function: getHostInitSettings File: ../../vpn/Api/ProfileMgr.cpp Line: 876 Profile () not found. Using default settings.
Jun 18 16:56:00 user-Dell acvpnui[5515]: Function: getCertList File: ../../vpn/Api/ApiCert.cpp Line: 325 Number of certificates found: 1
Jun 18 16:56:00 user-Dell acvpnui[5515]: Function: setConnectionData File: ../../vpn/Api/ConnectMgr.cpp Line: 1875 Certificate retrieved from preferences: Subject Name: DC=lt, DC=vlk, DC=vlkad, OU=Kiti, OU=Kontraktoriai, OU=Companies, CN=user Issuer Name : DC=lt, DC=vlk, DC=vlkad, CN=VLK CA Store : Firefox
Jun 18 16:56:00 user-Dell acvpnui[5515]: Message type information sent to the user: Contacting some_host.
Jun 18 16:56:00 user-Dell acvpnui[5515]: Initiating VPN connection to the secure gateway https://some_host
Jun 18 16:56:00 user-Dell acvpnagent[1373]: Using default preferences. Some settings (e.g. certificate matching) may not function as expected if a local profile is expected to be used. Verify that the selected host is in the server list section of the profile and that the profile is configured on the secure gateway.
Jun 18 16:56:00 user-Dell acvpnagent[1373]: Function: processConnectNotification File: ../../vpn/Agent/MainThread.cpp Line: 11423 Received connect notification (host some_host, profile N/A)
Jun 18 16:56:00 user-Dell acvpnagent[1373]: Function: GetSupportedIPProtocols File: ../../vpn/Api/PreferenceMgr.cpp Line: 231 The endpoint does not fully support IPv6. IPProtocolSupport value IPv4,IPv6 is being overridden and only IPv4 will be used.
Jun 18 16:56:00 user-Dell acvpnagent[1373]: Function: logResolutionResult File: ../../vpn/Common/Utility/HostLocator.cpp Line: 913 Host some_host has been resolved to IP address 111.111.111.111
Jun 18 16:56:00 user-Dell acvpnagent[1373]: Writing to hosts file:  111.111.111.111#011some_host ###Cisco AnyConnect VPN client modified this file. Please do not modify contents until this comment is removed. 
Jun 18 16:56:00 user-Dell acvpnagent[1373]: Function: respondToConnectNotification File: ../../vpn/Agent/MainThread.cpp Line: 4850 The requested VPN connection to some_host will target the following IP protocols and addresses: primary - IPv4 (address 111.111.111.111), secondary - N/A.
Jun 18 16:56:00 user-Dell acvpnui[5515]: Function: getUserName File: ../../vpn/Api/CTransportCurlStatic.cpp Line: 1928 PasswordEntry username is user
Jun 18 16:56:00 user-Dell acvpnui[5515]: Function: verify_callback File: ../../vpn/CommonCrypt/Certificates/FileCertificate.cpp Line: 355 Invoked Function: X509_verify_cert Return Code: 0 (0x00000000) Description: ok 
Jun 18 16:56:00 user-Dell acvpnui[5515]: message repeated 2 times: [ Function: verify_callback File: ../../vpn/CommonCrypt/Certificates/FileCertificate.cpp Line: 355 Invoked Function: X509_verify_cert Return Code: 0 (0x00000000) Description: ok ]
Jun 18 16:56:00 user-Dell acvpnui[5515]: Function: PeerCertVerifyCB File: ../../vpn/Api/CTransportCurlStatic.cpp Line: 857 Return success from VerifyServerCertificate
Jun 18 16:56:00 user-Dell acvpnui[5515]: Function: handleRedirects File: ../../vpn/Api/ConnectIfc.cpp Line: 826 Redirecting to: https://some_host/+webvpn+/index.html
Jun 18 16:56:00 user-Dell acvpnui[5515]: Function: setPromptAttributes File: ../../vpn/Api/ConnectMgr.cpp Line: 4058 The certificate authority is disabled on the secure gateway.
Jun 18 16:56:00 user-Dell acvpnui[5515]: The following error message was received from the secure gateway: Certificate Validation Failure
Jun 18 16:56:00 user-Dell acvpnui[5515]: Function: getPreference File: ../../vpn/Api/PreferenceInfoBase.cpp Line: 267 Invoked Function: getPreference Return Code: 0 (0x00000000) Description: Invalid preference 43 
Jun 18 16:56:00 user-Dell acvpnui[5515]: message repeated 2 times: [ Function: getPreference File: ../../vpn/Api/PreferenceInfoBase.cpp Line: 267 Invoked Function: getPreference Return Code: 0 (0x00000000) Description: Invalid preference 43 ]
Jun 18 16:56:00 user-Dell acvpnui[5515]: Function: isSWEnabled File: ../../vpn/Api/SDIMgr.cpp Line: 1027 Invoked Function: PreferenceMgr::getPreference Return Code: -30343157 (0xFE31000B) Description: PREFERENCEMGR_ERROR_PREFERENCE_NOT_FOUND SafeWordSofTokenIntegration
Jun 18 16:56:00 user-Dell acvpnui[5515]: Function: ProcessPromptData File: ../../vpn/Api/SDIMgr.cpp Line: 336 Authentication is not token based (OTP). 
Jun 18 16:56:00 user-Dell acvpnui[5515]: Function: nextClientCert File: ../../vpn/Api/ConnectMgr.cpp Line: 5193 Subject Name: DC=lt, DC=vlk, DC=vlkad, OU=Kiti, OU=Kontraktoriai, OU=Companies, CN=user Issuer Name : DC=lt, DC=vlk, DC=vlkad, CN=VLK CA Store : Firefox
Jun 18 16:56:00 user-Dell acvpnui[5515]: Function: getUserName File: ../../vpn/Api/CTransportCurlStatic.cpp Line: 1928 PasswordEntry username is user
Jun 18 16:56:00 user-Dell acvpnui[5515]: Function: verify_callback File: ../../vpn/CommonCrypt/Certificates/FileCertificate.cpp Line: 355 Invoked Function: X509_verify_cert Return Code: 0 (0x00000000) Description: ok 
Jun 18 16:56:00 user-Dell acvpnui[5515]: message repeated 2 times: [ Function: verify_callback File: ../../vpn/CommonCrypt/Certificates/FileCertificate.cpp Line: 355 Invoked Function: X509_verify_cert Return Code: 0 (0x00000000) Description: ok ]
Jun 18 16:56:00 user-Dell acvpnui[5515]: Function: PeerCertVerifyCB File: ../../vpn/Api/CTransportCurlStatic.cpp Line: 857 Return success from VerifyServerCertificate
Jun 18 16:56:00 user-Dell acvpnui[5515]: Function: getUserName File: ../../vpn/Api/CTransportCurlStatic.cpp Line: 1928 PasswordEntry username is user
Jun 18 16:56:00 user-Dell acvpnui[5515]: Function: setPromptAttributes File: ../../vpn/Api/ConnectMgr.cpp Line: 4058 The certificate authority is disabled on the secure gateway.
Jun 18 16:56:00 user-Dell acvpnui[5515]: Function: getPreference File: ../../vpn/Api/PreferenceInfoBase.cpp Line: 267 Invoked Function: getPreference Return Code: 0 (0x00000000) Description: Invalid preference 43 
Jun 18 16:56:00 user-Dell acvpnui[5515]: message repeated 2 times: [ Function: getPreference File: ../../vpn/Api/PreferenceInfoBase.cpp Line: 267 Invoked Function: getPreference Return Code: 0 (0x00000000) Description: Invalid preference 43 ]
Jun 18 16:56:00 user-Dell acvpnui[5515]: Function: isSWEnabled File: ../../vpn/Api/SDIMgr.cpp Line: 1027 Invoked Function: PreferenceMgr::getPreference Return Code: -30343157 (0xFE31000B) Description: PREFERENCEMGR_ERROR_PREFERENCE_NOT_FOUND SafeWordSofTokenIntegration
Jun 18 16:56:00 user-Dell acvpnui[5515]: Function: ProcessPromptData File: ../../vpn/Api/SDIMgr.cpp Line: 336 Authentication is not token based (OTP). 
Jun 18 16:56:00 user-Dell acvpnui[5515]: Function: getProfileNameFromHost File: ../../vpn/Api/ProfileMgr.cpp Line: 796 No profile available for host some_host.
Jun 18 16:56:00 user-Dell acvpnui[5515]: Function: getHostInitSettings File: ../../vpn/Api/ProfileMgr.cpp Line: 876 Profile () not found. Using default settings.
Jun 18 16:56:00 user-Dell acvpnui[5515]: Message type prompt sent to the user: Please enter your username and password.
Jun 18 16:56:22 user-Dell acvpnui[5515]: Function: userResponse File: ../../vpn/Api/ConnectMgr.cpp Line: 1316 Processing user response.
Jun 18 16:56:22 user-Dell acvpnui[5515]: Function: send File: ../../vpn/Api/ConnectIfc.cpp Line: 1061 Auth Cookie acquired
Jun 18 16:56:22 user-Dell acvpnui[5515]: Function: send File: ../../vpn/Api/ConnectIfc.cpp Line: 1069 Config Cookie acquired
Jun 18 16:56:22 user-Dell acvpnui[5515]: Function: processIfcData File: ../../vpn/Api/ConnectMgr.cpp Line: 2878 Authentication succeeded
Jun 18 16:56:22 user-Dell acvpnui[5515]: VPN state: Connecting Network state: Network Accessible Network control state: Network Access: Available Network type: Undefined
Jun 18 16:56:22 user-Dell acvpnui[5515]: Message type information sent to the user: Establishing VPN session...
Jun 18 16:56:22 user-Dell acvpnui[5515]: The group policy on the secure gateway does not have an AnyConnect profile configured. Though there may one or more local copies of AnyConnect profiles, the hardcoded default settings will be used.
Jun 18 16:56:22 user-Dell acvpnui[5515]: Function: SendRequest File: ../../vpn/Api/CTransportCurlStatic.cpp Line: 1375 Invoked Function: curl_easy_perform Return Code: -30015438 (0xFE360032) Description: CTRANSPORT_ERROR_HTTP_RETURNED_ERROR:The HTTP server returned an error code (>= 400) HTTP status code received 404
Jun 18 16:56:22 user-Dell acvpnui[5515]: message repeated 2 times: [ Function: SendRequest File: ../../vpn/Api/CTransportCurlStatic.cpp Line: 1375 Invoked Function: curl_easy_perform Return Code: -30015438 (0xFE360032) Description: CTRANSPORT_ERROR_HTTP_RETURNED_ERROR:The HTTP server returned an error code (>= 400) HTTP status code received 404]
Jun 18 16:56:22 user-Dell acvpnui[5515]: Function: getPackageURL File: ../../vpn/Api/ConnectIfc.cpp Line: 2513 Redirect encountered after authentication. This indicates the secure gateway did not receive a valid credential. Check the security settings in Internet Explorer; they may be set too high.
Jun 18 16:56:22 user-Dell acvpnui[5515]: Function: getUpdateFileContent File: ../../vpn/Api/ConnectIfc.cpp Line: 1366 Unable to locate Update file
Jun 18 16:56:22 user-Dell acvpnui[5515]: Function: TranslateStatusCode File: ../../vpn/Api/ConnectIfc.cpp Line: 2990 Invoked Function: TranslateStatusCode Return Code: -30080998 (0xFE35001A) Description: CONNECTIFC_ERROR_UPDATEFILE_NOT_FOUND Connection attempt failed.  Please try again.
Jun 18 16:56:22 user-Dell acvpnui[5515]: Function: useCachedDownloader File: ../../vpn/Api/ConnectMgr.cpp Line: 6687 Invoked Function: ConnectIfc::getUpdateFileContent Return Code: -30080998 (0xFE35001A) Description: CONNECTIFC_ERROR_UPDATEFILE_NOT_FOUND 
Jun 18 16:56:22 user-Dell acvpnui[5515]: Function: SendRequest File: ../../vpn/Api/CTransportCurlStatic.cpp Line: 1375 Invoked Function: curl_easy_perform Return Code: -30015438 (0xFE360032) Description: CTRANSPORT_ERROR_HTTP_RETURNED_ERROR:The HTTP server returned an error code (>= 400) HTTP status code received 404
Jun 18 16:56:22 user-Dell acvpnui[5515]: message repeated 2 times: [ Function: SendRequest File: ../../vpn/Api/CTransportCurlStatic.cpp Line: 1375 Invoked Function: curl_easy_perform Return Code: -30015438 (0xFE360032) Description: CTRANSPORT_ERROR_HTTP_RETURNED_ERROR:The HTTP server returned an error code (>= 400) HTTP status code received 404]
Jun 18 16:56:22 user-Dell acvpnui[5515]: Function: getPackageURL File: ../../vpn/Api/ConnectIfc.cpp Line: 2513 Redirect encountered after authentication. This indicates the secure gateway did not receive a valid credential. Check the security settings in Internet Explorer; they may be set too high.
Jun 18 16:56:22 user-Dell acvpnui[5515]: Function: getDownloader File: ../../vpn/Api/ConnectIfc.cpp Line: 1243 ConnectIfc::getPackageURL() is empty, unable to locate downloader
Jun 18 16:56:22 user-Dell acvpnui[5515]: Function: TranslateStatusCode File: ../../vpn/Api/ConnectIfc.cpp Line: 2990 Invoked Function: TranslateStatusCode Return Code: -30081007 (0xFE350011) Description: CONNECTIFC_ERROR_DOWNLOADER_NOT_FOUND The AnyConnect package on the secure gateway could not be located. You may be experiencing network connectivity issues. Please try connecting again.
Jun 18 16:56:22 user-Dell acvpnui[5515]: Function: launchRemoteDownloader File: ../../vpn/Api/ConnectMgr.cpp Line: 7091 Invoked Function: ConnectIfc::getDownloader Return Code: -30081007 (0xFE350011) Description: CONNECTIFC_ERROR_DOWNLOADER_NOT_FOUND 
Jun 18 16:56:22 user-Dell acvpnui[5515]: Function: launchDownloader File: ../../vpn/Api/ConnectMgr.cpp Line: 7275 Invoked Function: ConnectMgr::launchRemoteDownloader Return Code: -30081007 (0xFE350011) Description: CONNECTIFC_ERROR_DOWNLOADER_NOT_FOUND 
Jun 18 16:56:22 user-Dell acvpnui[5515]: Using default preferences. Some settings (e.g. certificate matching) may not function as expected if a local profile is expected to be used. Verify that the selected host is in the server list section of the profile and that the profile is configured on the secure gateway.
Jun 18 16:56:22 user-Dell acvpnui[5515]: Function: getProfileNameFromHost File: ../../vpn/Api/ProfileMgr.cpp Line: 796 No profile available for host some_host.
Jun 18 16:56:22 user-Dell acvpnui[5515]: message repeated 2 times: [ Function: getProfileNameFromHost File: ../../vpn/Api/ProfileMgr.cpp Line: 796 No profile available for host some_host.]
Jun 18 16:56:22 user-Dell acvpnui[5515]: Function: reloadPreferencesAfterUpdates File: ../../vpn/Api/ConnectMgr.cpp Line: 9314 Secure gateway (some_host) was not found in profile .
Jun 18 16:56:22 user-Dell acvpnui[5515]: Message type information sent to the user: Connection attempt has failed.
Jun 18 16:56:22 user-Dell acvpnui[5515]: Message type error sent to the user: The AnyConnect package on the secure gateway could not be located. You may be experiencing network connectivity issues. Please try connecting again.

在“通过 OpenConnect 成功连接，但实际上无法打开客户端网站并且 ping 仅给出响应一次”时记录：

Jun 18 17:02:31 user-Dell dbus[691]: [system] Activating service name='org.some_other_domain.hostname1' (using servicehelper)
Jun 18 17:02:31 user-Dell dbus[691]: [system] Successfully activated service 'org.some_other_domain.hostname1'
Jun 18 17:15:20 user-Dell NetworkManager[1042]: <info> Starting VPN service 'openconnect'...
Jun 18 17:15:20 user-Dell NetworkManager[1042]: <info> VPN service 'openconnect' started (org.some_other_domain.NetworkManager.openconnect), PID 7555
Jun 18 17:15:20 user-Dell NetworkManager[1042]: <info> VPN service 'openconnect' appeared; activating connections
Jun 18 17:15:25 user-Dell acvpnui[5515]: Function: detach File: ../../vpn/Api/ClientIfcBase.cpp Line: 438 Shutting down vpnapi
Jun 18 17:15:25 user-Dell acvpnagent[1373]: Function: OnIpcMessageReceived File: ../../vpn/Common/IPC/IPCDepot.cpp Line: 1047 Invoked Function: CIpcTransport::OnSocketReadComplete Return Code: -33292279 (0xFE040009) Description: IPCTRANSPORT_ERROR_UNEXPECTED 
Jun 18 17:15:28 user-Dell NetworkManager[1042]: <info> VPN plugin state changed: starting (3)
Jun 18 17:15:28 user-Dell NetworkManager[1042]:    SCPlugin-Ifupdown: devices added (path: /sys/devices/virtual/net/vpn0, iface: vpn0)
Jun 18 17:15:28 user-Dell NetworkManager[1042]:    SCPlugin-Ifupdown: device added (path: /sys/devices/virtual/net/vpn0, iface: vpn0): no ifupdown configuration found.
Jun 18 17:15:28 user-Dell NetworkManager[1042]: <warn> /sys/devices/virtual/net/vpn0: couldn't determine device driver; ignoring...
Jun 18 17:15:28 user-Dell NetworkManager[1042]: <info> VPN connection 'Something - OpenConnect' (Connect) reply received.
Jun 18 17:15:28 user-Dell openconnect[7579]: Attempting to connect to server 111.111.111.111:443
Jun 18 17:15:28 user-Dell openconnect[7579]: SSL negotiation with some_host
Jun 18 17:15:28 user-Dell openconnect[7579]: Connected to HTTPS on some_host
Jun 18 17:15:28 user-Dell openconnect[7579]: Got CONNECT response: HTTP/1.1 200 OK
Jun 18 17:15:28 user-Dell openconnect[7579]: CSTP connected. DPD 30, Keepalive 20
Jun 18 17:15:28 user-Dell NetworkManager[1042]: <info> VPN connection 'Something - OpenConnect' (IP Config Get) r

    

Answer 1

我意识到这有点晚了，也许你已经有了答案。根据我自己的调查，该错误是因为 AnyConnect 需要包含您的用户名的特定证书。

我无法确认/否认这一点，因为我无权访问我的组织内的证书颁发机构。不过，这里有几个链接可以帮助您解决问题。

http://www.cisco.com/en/US/tech/tk722/tk809/technologies_white_paper09186a008009256b.shtml#wp39121

https://supportforums.cisco.com/discussion/11533701/cisco-anyconnect-3008057-certificate-validation-failure

我的研究基于查看我自己的 eventvwr 并发现错误。不确定它是否会对您有帮助。

Answer 2

从Ubuntu 软件中心安装Cisco AnyConnect VPN 的 Open 客户端，然后使用命令。openconnect