VPN service - Support information

Please include the following information with your support request regarding the faulty VPN login attempt/problem:

• Exact time (day, hour, minute)
• Your IP address (IPv4) – can be found at https://www.heise.de/netze/tools/meine-ip-adresse
• Type/version of the operating system on the affected computer
• Version of the Cisco Secure Client,
• Brief description of the error/problem (ideally: error message word for word).

Information (31 January 2023): Windows versions older than Windows 10 are no longer supported by the current Cisco Secure Client (5.x). To resolve the issue, the affected computer can and should be updated to a current Windows version. Current Windows versions are currently available to BTU members under a campus licence.

Information (31 January 2023): Versions of macOS older than version 11 are no longer supported by the current Cisco Secure Client (5.x). To resolve the issue, the affected computer can and should be updated to a current version of macOS. See also: http://www.apple.com/uk/macos/how-to-upgrade

Information (31 January 2023): The software ‘Lenovo Rapid Boot’, ‘RapidBoot Shield’ or ‘RapidBoot HDD Accelerator’ may be responsible for the message ‘VPN Service not available’ appearing when starting the AnyConnect client. These products are incompatible with the AnyConnect client. Uninstall or deactivate them if you want to use the AnyConnect client.

Information (28 April 2022): The AnyConnect client should be uninstalled on macOS as follows:

Finder => Applications => Cisco => Uninstall AnyConnect

If you attempt to uninstall the software in any other way, remnants of the AnyConnect client may remain on the system, preventing the AnyConnect client from being reinstalled. If this is the case, you can try to remove these remnants of the AnyConnect client with the following command (in a command line):

sudo pkgutil --forget com.cisco.pkg.anyconnect.vpn

This requires entering the admin password for the macOS system in question.

Information (24 June 2021): Problems with AnyConnect Client version <= 4.10.01075 are currently being observed on macOS 11.4. Even when no VPN connection has been established, the CPU load of the processes com.cisco.anyconnect.macos.acsockext and mDNSResponder can rise to a very high value, around 100%. This behaviour is triggered by the configured ‘link-local’ address in the DNS configuration on one of the network adapters on the system. The bug is known to the manufacturer Cisco, who is working on a fixed version. Until this is available, the following workaround is recommended:

Check whether a ‘link-local’ address is present in the DNS configuration in one of the network adapters on the system (System Preferences => Network). If so, remove this ‘link-local’ address.

Note: This problem has not yet been observed in older macOS versions.

Information (17 April 2014): From version 3.1.x of the AnyConnect client onwards, access to the browser or system-internal certificate store is required to establish a VPN connection. This ensures that the Cisco AnyConnect client only establishes connections to trusted VPN servers.

If internal system access to the specified certificate stores is not possible, the following error message appears:

Security Warning: Untrusted VPN Server Certificate

AnyConnect cannot verify the VPN server: vpn-gate.tu-cottbus.de

...

To resolve the problem, we recommend activating the internal certificate store of the Cisco AnyConnect VPN client and importing the Deutsche Telekom Root CA 2 certificate into it. To do this, use the following commands on your Linux system:

mkdir -p ~/.cisco/certificates/ca

cd ~/.cisco/certificates/ca

wget

Information (29 October 2013): Under Mac OS X 10.9 (Mavericks), VPN connections via the Cisco AnyConnect Secure Mobility Client repeatedly crash. Cisco is aware of this problem. According to the company, a solution is already being worked on with Apple.

Addendum (04/11/2013): The problem has been fixed in version 3.1.04074 of the Cisco AnyConnect Secure Mobility Client.

Information (17 April 2013): During the automated installation and configuration of the Cisco AnyConnect VPN client, the process is currently being interrupted by the following security message: The signature for this application has expired. Until the problem is resolved, we recommend installing the Cisco AnyConnect Secure Mobility client manually. The individual steps required to do this are described here.

Information (26 October 2011): If the following error message appears when installing the Cisco AnyConnect Secue Mobility Client: ‘The VPN client agent was unable to create the interprocess communication depot.’ We recommend disabling ‘Share this connection to other network devices’ for all network cards on the system as follows:

• Start => Control Panel => Small icons (if necessary) => Network and Sharing Centre => Manage network connections (in Windows 7: Change adapter settings)
• Right-click on each network connection => Properties => Sharing
• Disable Internet connection sharing

Information (updated on 22 April 2025): If you are logging in to a Windows domain (located on the BTU campus network), you may need to establish a VPN connection to the campus network before logging in to Windows.

In Windows, the Cisco Secure Client offers the following setting: ‘Start before Login’. To use this setting, the following component of the Cisco AnyConnect Secure Mobility Client must be installed separately: cisco-secure-client-win-5.1.10.233-sbl-predeploy-k9.msi

As with PPP dial-up, the IP addresses are assigned dynamically by the VPN gateway. This means that the VPN client is not always assigned the same IP address. On Windows PCs, this can lead to irregularities, especially when the IPSec connection is established and terminated multiple times. You can solve this problem by creating the file Lmhosts on the client PC (see also the documentation for your Windows operating system). In this file, enter the fixed assignment of the IP address to its name in the Windows environment for your target computer. For NT servers, the domain name must also be entered. If necessary, contact the system administrator in your department for the required data.