AnyConnect "Connection attempt has failed" — finding the error underneath
Published · Updated
When Cisco AnyConnect reports that the connection attempt has failed, that is a wrapper, not a diagnosis. AnyConnect shows it for at least a dozen distinct failures — DNS, TLS, authentication, licensing, posture. Every generic checklist you will find works by guessing through all of them. Reading the underlying error takes two minutes and tells you which one you have.
Finding the actual error
The specific failure is written to the client log even though the UI hides it.
Fastest route — in the client, open Message History (the icon beside the gear). The line above the generic failure is the real one.
Full detail — Event Viewer → Applications and Services Logs → Cisco AnyConnect Secure Mobility Client. Look for the last Error before the failure.
Then match what you find:
“Unable to resolve host”
DNS. The client cannot turn the gateway hostname into an address. Test with nslookup vpn.yourcompany.com. If that fails but general browsing works, you are likely on a network with a captive portal, or using a DNS service that blocks the lookup. Common on hotel and guest Wi-Fi.
“The server certificate could not be verified” / TLS errors
A certificate problem wearing a different hat — see certificate validation failure.
“Login failed” / “Authentication failed”
You reached the gateway and were rejected. Check whether your password expired — many organisations enforce rotation, and AnyConnect surfaces an expired password as a plain login failure. If you use MFA, confirm your token has not drifted or been reset onto a new phone.
“No valid certificates available for authentication”
The gateway wants a client certificate your machine does not have. Usual on a new or rebuilt device: certificate enrolment did not run. Your IT team must issue it — there is no local workaround.
“Connection attempt has failed due to server communication errors”
You reached something, but not a working gateway. Either the address is wrong, or the gateway is down, or something between you and it is dropping the connection. Test whether the port is even open:
Test-NetConnection vpn.yourcompany.com -Port 443TcpTestSucceeded : False means it is blocked or down, and no client setting will change that.
“The VPN client agent was unable to create the interprocess communication depot”
An internal client fault, usually another VPN product holding the local socket. Close other VPN clients, then Restart-Service vpnagent -Force from an elevated prompt.
“Posture assessment failed” / “Your system does not meet requirements”
You authenticated, but the endpoint compliance check rejected the machine — out-of-date antivirus, missing patches, disabled disk encryption. The message rarely says which. Your IT team can see the specific failed condition in the ISE or ASA logs.
The twelve-second timeout
A recognisable pattern: the connection fails after roughly twelve seconds, every time, on an otherwise healthy setup. That is usually MFA — the gateway is waiting for your second factor and giving up before you approve it.
If you are not seeing a push notification, the token is registered to a device you no longer carry, or notifications are suppressed. Open the authenticator app manually and approve from inside it rather than waiting for the push.
Why it works at home and fails elsewhere
If home works but a hotel, café, or client site does not, the network is filtering:
- Captive portal not completed. Open any plain
http://site to trigger the login page. Many portals will not intercept HTTPS, so the VPN just fails with no explanation. - UDP 443 blocked. AnyConnect prefers DTLS over UDP 443 and falls back to TCP. Some networks drop UDP silently, adding a long delay before fallback.
- VPN passthrough disabled. Some guest networks block VPN protocols deliberately.
A phone hotspot is the fastest test. If it connects instantly on mobile data, the problem is that network, not your laptop.
When to stop and escalate
Escalate immediately, with your DART bundle attached, if you see any of: no valid certificates available, posture assessment failed, login failed with a password you know is correct, or a failure that started for several people at once. All of these are resolved on the server, and time spent on your own machine is time wasted.
Frequently asked
Where do I find the real AnyConnect error message?
Open Message History in the client — the line above the generic failure is the specific error. For full detail use Event Viewer under Applications and Services Logs, then Cisco AnyConnect Secure Mobility Client, and read the last Error entry before the failure.
Why does AnyConnect fail after about twelve seconds every time?
That timing usually indicates multi-factor authentication timing out. The gateway is waiting for your second factor and giving up before you approve it. Open your authenticator app directly and approve from within it rather than waiting for a push notification, which may be going to a device you no longer use.
The VPN works at home but not at my hotel. Why?
Guest and hotel networks commonly block VPN traffic, drop UDP 443 which AnyConnect prefers for DTLS, or require a captive portal login you have not completed. Open any plain http site to trigger the portal. Testing on a phone hotspot confirms it quickly: if it connects on mobile data, the hotel network is the cause.
What is a DART bundle and why does support want it?
DART is the Diagnostic and Reporting Tool bundled with every AnyConnect installation. It collects the relevant client logs, configuration, and system information into a single zip file. Attaching it to your first ticket usually removes a full round of back-and-forth, because support can see the actual error rather than the generic one.