cisco anyconnect "secure vpn connection terminated locally by the client"

TL;DR

This message means the client itself tore the tunnel down, most often an idle timeout, a network interface change, or a conflicting adapter. Check the client logs for the trigger, stabilize the network path, and adjust timeout or reconnect settings.

The query

cisco anyconnect "secure vpn connection terminated locally by the client"

Use this when

• AnyConnect logs show terminated locally by the client
• disconnects happen on Wi-Fi roams or sleep/wake
• the tunnel drops while the user is idle

Not for

• login failed or authentication errors
• gateway not responding or unreachable errors
• certificate validation failures

Steps

1. Open the AnyConnect DART or event logs around the disconnect timestamp and find the trigger event. Expected output: the log names the cause, such as idle timeout or interface change.
2. Ask whether the disconnect aligns with sleep, Wi-Fi roaming, or VPN idle periods. Expected output: a pattern emerges linking disconnects to an event.
3. Disable conflicting virtual adapters and confirm only one AnyConnect adapter is active. Expected output: a single clean adapter state.
4. Check the profile for idle timeout and dead-peer-detection settings with the VPN admin. Expected output: timeout values are known and sane for the use case.
5. Update the AnyConnect client to the current supported version and retest. Expected output: disconnects stop or the log shows a new actionable cause.

Applies to

Cisco AnyConnect Secure Mobility Client 4.x/5.x, Cisco ASA and FTD headends, Windows and macOS.

Variant phrasings

Disconnects every few minutes on stable Wi-Fi

Likely dead-peer detection or a middlebox killing idle UDP; check DTLS vs TLS fallback.

Disconnects only on hotel or guest Wi-Fi

Captive portal or aggressive NAT timeouts; the client gives up and reports local termination.

Why it happens

The client tears down the tunnel itself when its keepalives fail, the OS signals a network change, or a policy timer fires. The message describes who ended it, not why, so the logs carry the real answer.

Edge cases

• Always-on profiles can fight user-initiated disconnects; check the profile intent.
• Third-party endpoint security with its own VPN driver often conflicts; exclude or remove one.
• Collect DART before escalating; without logs the headend admin cannot help.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_-bX3-1k3Ogg6xOaYpZWgfg