Troubleshoot Secure Access Error “VPN Establishment Capability for a Remote User Is Disabled. A VPN Connection Will Not Be Established”

Introduction

This document describes how to resolve error:  “VPN establishment capability for a remote user is disabled. A VPN connection will not be established.”

Problem

When a user tries to connect with RA-VPN (Remote Access VPN) to the Secure Access headend, the error is printed in the Cisco Secure Client notification popup:

• VPN establishment capability for a remote user is disabled. A VPN connection will not be established.
• Cisco Secure Client was not able to establish a connection to the specified secure gateway. Please try connecting again.

Cisco Secure Client – Problem connecting to Cisco Secure Access

mentioned error generated , user connected RDP Windows PC , tries connect RA – VPN given PC ,  WindowsVPN Establishment is set to Local Users Only (default option).

Windows VPN Establishment determines the behavior of the Cisco Secure Client when a user who is remotely logged on to the client PC establishes a VPN connection. The possible values are:

Prevents a remotely logged-on (RDP) user from establishing a VPN connection.

Allows remote users to establish a VPN connection. However, if the configured VPN connection routing causes the remote user to become disconnected, the VPN connection terminates to allow the remote user to regain access to the clients PC. Remote users must wait 90 seconds after VPN establishment if they want to disconnect their remote login session without causing the VPN connection to be terminated.

Solution

Navigate Cisco Secure Access Dashboard .

• Click  Connect > End User Connectivity 
• Click  Virtual Private Network
• Choose the profile that you want to modify and click  Edit  

Cisco Secure Access – RA-VPN

Click  Cisco Secure Client Configuration > Client Settings > Edit

Cisco Secure Access – RA-PVN Client Configuration

Click  Administrator Settigns and modify Windows VPN Establishment from Local User Only to Remote Users

Cisco Secure Access – Windows Windows VPN Establishment

And click on Save

Cisco Secure Access – Windows Windows VPN Establishment 2

establish RA – VPN session remote Windows PC , you is configure configureTunnel Mode as Bypass Secure Access. Otherwise, you risk losing access to the remote Windows PC.

Cisco Secure Access – Tunnel Mode

informationTunnel Mode  check article item number6:

https://docs.sse.cisco.com/sse-user-guide/docs/add-vpn-profiles

Related Information