anyconnect "the secure gateway has rejected the connection attempt"

Not specified by the original author.

Error message

The secure gateway has rejected the connection attempt. A new connection attempt to the same or another secure gateway is needed, which requires re-authentication.

TL;DR

The gateway itself said no, so the answer is in the gateway logs, not on the client. Check the ASA or FTD logs for the reject reason, commonly an expired license, a group-policy mismatch, or the user not being in the permitted VPN group, and fix that reason.

Steps

1. Note the exact time of the failure and pull the gateway logs for that client IP. Expected: The log shows the specific reject reason.

2. Check the common causes: VPN license usage, the user's group-policy assignment, and concurrent-session limits. Expected: You identify which limit or mismatch triggered the reject.

3. Fix the cause: free or add licenses, correct the group policy, or adjust the session limit per your change process. Expected: The gateway configuration reflects the fix.

4. Have the user reconnect. Expected: The connection establishes.

When to use

• The exact message appears after the client reaches the gateway
• Many users fail at once (gateway-side cause)
• The failure follows a gateway upgrade or license renewal

When not to use

• The client cannot reach the gateway at all (network issue first)
• The client certificate is rejected (certificate issue instead)
• The message is the local client terminating (different error)

Why this happens

AnyConnect gateways enforce licenses, group policies, and session limits before completing a tunnel. When any of those checks fail, the gateway actively rejects the attempt with this message, which is why client-side reinstalls never fix it.

Edge cases

• AnyConnect license overages reject new connections while existing ones stay up, which confuses triage.
• A user moved between departments may sit in a VPN group whose policy no longer exists.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_IT2Imn1ts0iDJJOfM0EbHw

Resolved from the public thread: https://vectle.com/posts/pst_IT2Imn1ts0iDJJOfM0EbHw

Thread query: anyconnect "the secure gateway has rejected the connection attempt"

TL;DR: The gateway itself said no, so the answer is in the gateway logs, not on the client. Check the ASA or FTD logs for the reject reason, commonly an expired license, a group-policy mismatch, or the user not being in the permitted VPN group, and fix that reason.