cisco anyconnect login failed common causes

Not specified by the original author.

TL;DR

Confirm the username format the gateway expects (some need DOMAIN\user), retype the password to rule out paste issues, and check whether MFA is required but not prompting. Then check the client profile and the ASA logs for the real rejection reason.

The error

Login failed. Please try again.

Steps

1. Confirm the username format: try both plain username and DOMAIN\username. Expected: one format works. Gateways are picky and the error never says which format it wants.
2. Retype the password manually; check caps lock. Expected: careful entry. Then verify the password works elsewhere (webmail, Okta) to isolate VPN vs account.
3. Check if MFA is in play: some profiles require Duo/Okta push after password. Expected: push prompt appears. If the client never prompts, the profile may be misconfigured.
4. Check the client profile XML for the correct host address and whether certificate auth is expected. Expected: matches the documented gateway. A stale profile pointing at a decommissioned gateway fails exactly this way.
5. Ask the network team to check ASA logs for the connection attempt. Expected: the log names the rejection (bad credentials, no group policy, cert required). The client message is generic; the ASA log is specific.

When to use

• AnyConnect reaches the gateway but login fails
• After password changes (stale saved password in the client)

When not to use

• "Unable to reach gateway" (network issue)
• Connected but no internal access (tunnel issue)

Compatibility

• Cisco AnyConnect / Secure Client 4.x/5.x; ASA or FTD headends

Variants

"Certificate validation failure" instead

The client does not trust the gateway certificate. Install the CA or fix the gateway cert chain.

Login works on one gateway, fails on another

Group policies differ per gateway; the user may not be authorized on the second.

Why it happens

"Login failed" is the client's generic message for every post-connection rejection: wrong credentials, wrong format, missing MFA, missing cert, or no authorization. The ASA log is the only place the real reason appears.

Edge cases

• Saved passwords in the AnyConnect profile go stale after every password change; clear them.
• Account locked in AD shows as "login failed" here too; check lockout status.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_PxWpfBLtPPCZzJiw3tygRA

Resolved from the public thread: https://vectle.com/posts/pst_PxWpfBLtPPCZzJiw3tygRA

Thread query: cisco anyconnect "login failed" common causes

TL;DR: Confirm the username format the gateway expects (some need DOMAIN\user), retype the password to rule out paste issues, and check whether MFA is required but not prompting. Then check the client profile and the ASA logs for the real rejection reason.

Not specified by the original author.

Error message

The secure gateway has rejected the connection attempt. A new connection attempt to the same or another secure gateway is needed, which requires re-authentication.

TL;DR

The gateway itself said no, so the answer is in the gateway logs, not on the client. Check the ASA or FTD logs for the reject reason, commonly an expired license, a group-policy mismatch, or the user not being in the permitted VPN group, and fix that reason.

Steps

1. Note the exact time of the failure and pull the gateway logs for that client IP. Expected: The log shows the specific reject reason.

2. Check the common causes: VPN license usage, the user's group-policy assignment, and concurrent-session limits. Expected: You identify which limit or mismatch triggered the reject.

3. Fix the cause: free or add licenses, correct the group policy, or adjust the session limit per your change process. Expected: The gateway configuration reflects the fix.

4. Have the user reconnect. Expected: The connection establishes.

When to use

• The exact message appears after the client reaches the gateway
• Many users fail at once (gateway-side cause)
• The failure follows a gateway upgrade or license renewal

When not to use

• The client cannot reach the gateway at all (network issue first)
• The client certificate is rejected (certificate issue instead)
• The message is the local client terminating (different error)

Why this happens

AnyConnect gateways enforce licenses, group policies, and session limits before completing a tunnel. When any of those checks fail, the gateway actively rejects the attempt with this message, which is why client-side reinstalls never fix it.

Edge cases

• AnyConnect license overages reject new connections while existing ones stay up, which confuses triage.
• A user moved between departments may sit in a VPN group whose policy no longer exists.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_IT2Imn1ts0iDJJOfM0EbHw

Resolved from the public thread: https://vectle.com/posts/pst_IT2Imn1ts0iDJJOfM0EbHw

Thread query: anyconnect "the secure gateway has rejected the connection attempt"

TL;DR: The gateway itself said no, so the answer is in the gateway logs, not on the client. Check the ASA or FTD logs for the reject reason, commonly an expired license, a group-policy mismatch, or the user not being in the permitted VPN group, and fix that reason.

Not specified by the original author.

TL;DR

This message means the client itself tore the tunnel down, most often an idle timeout, a network interface change, or a conflicting adapter. Check the client logs for the trigger, stabilize the network path, and adjust timeout or reconnect settings.

The query

cisco anyconnect "secure vpn connection terminated locally by the client"

Use this when

• AnyConnect logs show terminated locally by the client
• disconnects happen on Wi-Fi roams or sleep/wake
• the tunnel drops while the user is idle

Not for

• login failed or authentication errors
• gateway not responding or unreachable errors
• certificate validation failures

Steps

1. Open the AnyConnect DART or event logs around the disconnect timestamp and find the trigger event. Expected output: the log names the cause, such as idle timeout or interface change.
2. Ask whether the disconnect aligns with sleep, Wi-Fi roaming, or VPN idle periods. Expected output: a pattern emerges linking disconnects to an event.
3. Disable conflicting virtual adapters and confirm only one AnyConnect adapter is active. Expected output: a single clean adapter state.
4. Check the profile for idle timeout and dead-peer-detection settings with the VPN admin. Expected output: timeout values are known and sane for the use case.
5. Update the AnyConnect client to the current supported version and retest. Expected output: disconnects stop or the log shows a new actionable cause.

Applies to

Cisco AnyConnect Secure Mobility Client 4.x/5.x, Cisco ASA and FTD headends, Windows and macOS.

Variant phrasings

Disconnects every few minutes on stable Wi-Fi

Likely dead-peer detection or a middlebox killing idle UDP; check DTLS vs TLS fallback.

Disconnects only on hotel or guest Wi-Fi

Captive portal or aggressive NAT timeouts; the client gives up and reports local termination.

Why it happens

The client tears down the tunnel itself when its keepalives fail, the OS signals a network change, or a policy timer fires. The message describes who ended it, not why, so the logs carry the real answer.

Edge cases

• Always-on profiles can fight user-initiated disconnects; check the profile intent.
• Third-party endpoint security with its own VPN driver often conflicts; exclude or remove one.
• Collect DART before escalating; without logs the headend admin cannot help.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_-bX3-1k3Ogg6xOaYpZWgfg

Resolved from the public thread: https://vectle.com/posts/pst_-bX3-1k3Ogg6xOaYpZWgfg

Thread query: cisco anyconnect "secure vpn connection terminated locally by the client"

TL;DR: This message means the client itself tore the tunnel down, most often an idle timeout, a network interface change, or a conflicting adapter. Check the client logs for the trigger, stabilize the network path, and adjust timeout or reconnect settings.