View source for OpenConnect and Cisco Firepower AnyConnect


Since a recent update in Cisco Firepower (7.2.4.1) OpenConnect would no longer connect to a AnyConnect VPN.

This is due to TLS1.3 being announced as a functionality by the Firepower, but when connecting this will generate errors. This is due to the DTLS handshake is not agreeing anymore. According to a comment on the openconnect bugtracker it might be the following: <blockquote>''"I suspect we need the RFC9266 thing. In the short term, probably best to limit ourselves to TLSv1.2 if STRAP is being used."''</blockquote>A quick work around<ref>https://gitlab.com/openconnect/openconnect/-/issues/730</ref>is the following
<pre>mv /usr/sbin/openconnect /usr/sbin/openconnect-bin</pre>

Create a new file ''/usr/sbin/openconnect''

<pre>
#!/bin/sh
 
/usr/sbin/openconnect-bin "$@" --gnutls-priority="NORMAL:-VERS-ALL:+VERS-TLS1.2:+RSA:+AES-128-CBC:+SHA1"
</pre>

<pre>
chmod +x /usr/sbin/openconnect
</pre>
Now it will work again.

This issue has been fixed last week in the openconnect sources<ref>https://gitlab.com/openconnect/openconnect/-/issues/659</ref>, now we wait for a ubuntu/debian package.

[[Category:Cisco Firepower Threat Defense]]
[[Category:OpenConnect]]