Loading...
Loading...
After upgrading the FTD headend to version 7.4.1, AnyConnect/Secure Client is not able to establish a VPN session when HostScan/Secure Firewall Posture is enabled. The behavior is experienced as the FTD is not able to process the scanning results posted by the client when the file exceeds the 25,000 bytes. - When using the AnyConnect client with HostScan package enabled in the headend, the posture assessment process is stuck and displays the "Posture: Initiating..." message after the user successfully authenticates. - When using Cisco Secure Client with Secure Firewall Posture package enabled in the headend, the posture assessment process is stuck and displays the "HostScan mission complete" message after the user successfully authenticates. - On the VPN headend in "show counters" output below counter is increasing: ------------------ show counters ------------------ Protocol Counter Value Context ... ZERO_TRUST HUGE_PAYLOAD 354 Summary ...
- FTD version 7.4.1 - Cisco Secure Client / AnyConnect client, regardless of the version - Scanning results file exceeds 25,000 bytes (scan.xml posted by the client to the FTD headend).
1. Navigate to the lina CLI (system support diagnostic-cli) and verify the current "hostscan data-limit" configuration by running the commands below: FTD01# show run webvpn hostscan data-limit 2. If the command above does not return any value, it means there is no hostscan data-limit set, and therefore the default value is 200kB. Run command below: FTD01# debug menu zero-trust 10 200000 2.1. If hostscan data-limit is not default and is set to a certain value, the debug menu command must match the hostscan-data limit. As shown in the example below. FTD01# show run webvpn hostscan data-limit hostscan data-limit 127000 FTD01# debug menu zero-trust 10 127000 FTD01# Note that the debug command is only valid for the duration of the FTD uptime. If the FTD headend reboots, the "debug menu zero-trust" value will default back to 25000 bytes. Therefore, the workaround will need to be applied upon every reboot.
HostScan and Secure Firewall Posture are used to perform posture assessment checks on endpoints before allowing VPN access. This issue impacts the VPN session establishment process, leading to user authentication hanging indefinitely. The counter 'HUGE_PAYLOAD' indicates that the client's scan.xml file exceeded the payload processing limit set on the FTD.
Click on a version to see all relevant bugs
Cisco Integration
Learn more about where this data comes from
Bug Scrub Advisor
Streamline upgrades with automated vendor bug scrubs
BugZero Enterprise
Wish you caught this bug sooner? Get proactive today.