Anyconnect 4.8.03052 failed to launch downloader

[aravikumar]

Hello All,

While we are testing Posture for wired is working for Windows and Mac (With 3 min delay in macintosh ) after posture compliance we were able to access internet.

While we were testing wireless for both windows and mac, The Anyconnect was throwing an error "Failed to Launch Downloader". We tried doing telnet to ISE IP on 8443 and 8905 telnet was happening from client machine.  From Network side everything seems to be fine, we were able to ping websites, 8.8.8.8 and also do nslookup to ISE IP address and enroll.cisco.com. We also tried with lower version of compliance module but we were still facing the same error.

Anyconnect Version: anyconnect-win-4.8.03052-predeploy-k9

Compliance module version: anyconnect-win-4.3.1250.6145-isecompliance

ISE version: 2.6 patch 6

Any help would be appreciated.

Thanks,

Aravind.

[Mike.Cifelli]

I recently went through something similar. Please provide additional information so we can better assist.
-Are you attempting to rely on ISE CPP to update client software?
-Under your AnyConnect Configuration that gets assigned to CPP result do you have a minimum software required under the deferral section?
-On a machine facing the issue, check this path and let us know if you see anything in there: C:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client\Temp\Downloader.
-Do you have applocker or any other software on your clients that may be preventing the executable from running?

[ahollifield]

Did this ever get resolved?  Seeing the same thing on ISE 2.6 and AnyConnect 4.9.  

-Are you attempting to rely on ISE CPP to update client software? -YES
-Under your AnyConnect Configuration that gets assigned to CPP result do you have a minimum software required under the deferral section? -NO
-On a machine facing the issue, check this path and let us know if you see anything in there: C:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client\Temp\Downloader. - YES There is a downloader exe present here.
-Do you have applocker or any other software on your clients that may be preventing the executable from running? - NO

[Mike.Cifelli]

So my issue was attempting to provision/upgrade while connected to the VPN via the ISE CPP.  Are you attempting to do the same while on an established VPN session? If you take a test client and view the event application logs for AnyConnect you will see some informational logs during the test/upgrade fail that state something along the lines of 'AnyConnect cannot perform the upgrade while connected to the VPN.  Please contact your System Administrator'.  The issue I had is that while you are on the VPN the upgrade is not going to work so to answer your question we are relying on other mechanisms.  I spent a decent amount of time with TAC on this one, and they suggested possibly doing webdeploy via ASA, which will require additional config/testing.  Lastly, I can tell you that while on wired/wireless on site (no VPN) the provision/upgrade works as expected.  HTH!

[russ.carter]

Not sure if it helps you but I had the same issue with AnyConnect 4.9 and ISE 2.6. I tried various compliance modules that ISE had downloaded but they all failed with a message saying the installer file type is not recognised.

I checked the Cisco site to try to find a Windows version of the compliance module to try to install it manually and found that the ones I was trying to install via ISE weren't on the list of available downloads...so I changed the ISE config to use the latest that was on the Cisco download site (4.3.2099.614) and it worked first time via the ISE CPP.

Not sure if this is by design and some versions are known not to work so have been removed, or if it was just luck, but worth a try.