## TL;DR
Upgrade AnyConnect to a Sequoia-supported release (4.10 MR7+ / Secure Client 5.1+), then re-approve the system extension and the firewall/network filter permission in System Settings > Privacy and Security. Sequoia tightened network extension approvals and old clients break silently.

## The error
```text
The VPN client failed to establish a connection. / AnyConnect will not start after the Sequoia upgrade.
```

## Steps
1. Check the AnyConnect version: AnyConnect > About. Expected: version noted. Anything below the Sequoia-supported release must be upgraded first.
2. Install the supported release from the company's software portal. Expected: install completes. Do not install from Cisco's public site; use the profiled corporate build.
3. Open System Settings > Privacy and Security and look for blocked system extension or network filter alerts mentioning Cisco. Expected: approval prompt present. Click Allow and authenticate.
4. Go to System Settings > Network > Filters and confirm the Cisco filter is enabled. Expected: enabled. Sequoia can leave it disabled after upgrade.
5. Reconnect. Expected: tunnel establishes. If it still fails, collect logs and check whether the corporate profile needs updating for Sequoia.

## When to use
- AnyConnect broken immediately after Sequoia upgrade
- Fresh Sequoia installs with old AnyConnect

## When not to use
- Other macOS versions (different fixes)
- Windows AnyConnect issues

## Compatibility
- macOS Sequoia (15.x); AnyConnect 4.10 MR7+ / Secure Client 5.1+

## Variants
### "System extension blocked" with no Allow button
An MDM restriction may block user approval; the MDM team must allowlist the extension.
### Works for admins but not standard users
The approval was done per-user; standard users need the MDM-pushed approval.

## Why it happens
Sequoia changed how network system extensions are approved and loaded. Clients built before the change cannot load their tunnel driver, so every connection stage fails.

## Edge cases
- Beta macOS versions: no supported client exists; advise against beta on corporate devices.
- Document the minimum client version in the MDM so new enrollments get it automatically.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_47tsGLImsloZNhddfgvNVQ