How to Fix OpenConnect Errors on Windows 10

OpenConnect is a program and tool compatible with Cisco protocols, with the help of which SSL VPN users can connect to their workplace remotely in a completely secure way. This program has the ability to connect to Cisco AnyConnect and Ocserv gateways. After reading this post you will learn How to Fix OpenConnect Errors on Windows 10. Therefore, we recommend you stay with us until the end of this practical article.

What is OpenConnect?

OpenConnect is a client for the Cisco AnyConnect VPN service and is used on the Linux operating system. Meanwhile, OpenConnect is not dependent on Cisco servers. In fact, after several security vulnerabilities were discovered in Cisco equipment, OpenConnect was redeveloped to fix the problems and remove its dependence on Cisco. Currently, OpenConnect has solved all the shortcomings of Cisco clients. This has made it known as one of the pioneers of Cisco’s alternative for Linux users.

Features of OpenConnect

– Simple user interface and ability to connect with just one click

– Support for RSA SecurID and TOTP software tokens

– Support for ARM, x86, x64, ARM64 processors

– Built on the popular OpenConnect Linux package

– Free and in-app version

– No need for a rooted device

Troubleshooting OpenConnect Errors on Windows 10

In the rest of this article, we will mention the types of errors when using OpenConnect. Then we will explain to you how to fix these errors. You can install and run OpenConnect after reviewing and checking the quality plans of the Windows VPS server provided on our website.

“No SSO handler” error in Openconnect for Windows 10

You may be looking to enable SSO/MFA on your Openconnect. Since Openconnect supports SAML-based authentication, you might want to upgrade to version 9.01 to try it out. You will get the message “No SSO handler” when trying to use it:

POST https://vpn.##########.com/
Connected to xx.xx.xx.xx:443
SSL negotiation with vpn.##########.com
Server certificate verify failed: signer not found
Connected to HTTPS on vpn.##########.com with ciphersuite (TLS1.2)-(ECDHE-SECP256R1)-(RSA-SHA512)-(AES-256-GCM)
XML POST enabled
Please complete the authentication process in the AnyConnect Login window.
GROUP: [Main_VPN]:Main_VPN
No SSO handler
Failed to complete authentication

If you want to use the “–external-browser” flag with the required command on the ASA side, you should use the following workaround.

Solution:

There is a difference in how the SAML SSO protocol works and the SAML external browser SSO protocol (both are supported in OpenConnect). On the other hand, some gateways are only able to perform SAML SSO protocol due to some hardware requirements by Cisco.

It is interesting to note that the –external-browser flag/function is tied to the SAML external browser flow. The important point and the reason for the missing flag in Windows is that Windows does not support posix_spawn.

However, there are two potential solutions for working with OpenConnect on Windows or Admin RDP:

Set up a Windows-only callback for the external browser stream that does one of two things.

Copy-paste the standard exit link for the user to complete the authentication process in the browser.
Use Win32 CreateProcess to create a browser instance to complete the verification.

Could not open vpnc.log: 5

If you use OpenConnect-GUI for Windows, you may receive the following error message:

Could not open C:/Users/XXXX/AppData/Local/Temp\vpnc.log: 5

We will tell you the solution to fix the vpnc.log problem or a completely clean system for a fresh start with OpenConnect-GUI.

Solution:

This error occurs when the vpnc scripts are not running. In other words, the vpnc.log file is not generated. It may also mean that the UI cannot load/process it. Be careful that this error is due to the wrong connection of the js files. To fix this error, you can follow the steps below.

In the first step, you need to search for and run Cmd from the start menu.

To access the folder where OpenConnectGUI is installed and the vpnc-script.js file is there, you can use the following command:

cscript vpnc-script.js

If the above method does not work, you can do the following.

Open the Run window from the start menu.

Run the following command:

regedit.exe

Find the following path:

\HKEY_CLASSES_ROOT.js

Now you need to set the default value to JSFile.

Failed to write to SSL socket: The transmitted packet is too large (EMSGSIZE)

You may have installed openconnect-gui-1.5.3-win32.exe and then configured it to connect to Cisco VPN. It still shows as connected, but you can’t ping the gateway or pass anything through it.

This error occurs when you run OpenConnect in DTLS mode, which is the default. Be careful that this error can stop the connection completely.

Solution:

Considering that this error is related to the MTU size of the connection and the size of the packets, you should reduce the MTU of the connection to fix it. To do this, just add the following command to OpenConnect in the config file or command line:

--base-mtu=1450

If you still get the error message, decrease the value of 1450 by 50 points to resolve the error.

Conclusion

OpenConnect is open-source software for connecting to virtual private networks (VPNs) that implements secure point-to-point connections. This software was originally written as an open-source alternative to Cisco’s proprietary AnyConnect software, which is an SSL VPN client supported by several Cisco routers. You may encounter errors when using and running this software in Windows. For this reason, in this article, we tried to teach you How to Fix OpenConnect Errors on Windows 10. If you encounter another error, tell us about it in the comments section.