2

I have 2 VPN and sometimes I should switch them very often. I decided to create .bat file which could connect to desired VPN with credentials set in this file.

So I create .bat file with following code:

vpncli.exe -s < 1.txt

Where 1.txt contains credentials of VPN #1 which has trusted cerficate. here's what 1.txt contains:

connect <vpn1.some.host>
1
<password>

Where 1 goes for GROUP with number 1.

The second VPN is untrusted and I have this prompt awaring me what VPN is untrusted. I used similar code for .bat file:

vpncli.exe -s < 2.txt

And following data in 2.txt:

connect <vpn2.some.host>
y
<GROUP>
<LOGIN>
<PASSWORD>

("y" goes for accepting untrusted server)

But now it says "Login failed" after entering password is prompted and then it appears in loop and never stops.

The question is: how should I modify my 2.txt file to make script connect to VPN #2?

  • What is the version of AnyConnect CLI you are trying ? Have you implemented your own CLI or just using the one shipped with AnyConnect ? – Mahesh Jul 22 '16 at 16:00
  • I didn't do anything so I guess it's the one shipped with AnyConnect. The version is 3.1.14018 – Roman Jul 23 '16 at 8:37
1

AnyConnect's behavior with untrusted server handling is detailed in the admin guide. Please refer to it for details.

If your client is configured to block connections to untrusted servers, first your input text needs to be modified to change the preference to accept connections. This is the case of handling the red prompt (Untrusted error) as mentioned in the admin guide. Text input -

connect <vpn2.some.host>
y
y

Once you saved the preference, you have to re-initiate the connection. This time client will provide options to continue connection and import the certificate as well. Among other certificate errors, AnyConnect will allow user to import the certificate only if the source is untrusted. For example, if the certificate is expired, user can not import the certificate. This is the case of handling the white prompt (Untrusted warning).

In your text input, you are actually missing the input for importing the certificate. So, try -

connect <vpn2.some.host>
y
n
<GROUP>
<LOGIN>
<PASSWORD>

If you wish to import the certificate, replace n with y. Since your certificate is already imported, for future connections your input text will look just like the first one (i.e., trusted certificate). Hope this is helpful.

  • I tried your text input without "n" in the third line and it worked well! great thanks, Mahesh! – Roman Jul 23 '16 at 12:51
  • Glad it worked. Now that you have imported the server certificate, your future connections for the same host must not have y,n inputs on 2nd, 3rd lines. – Mahesh Jul 23 '16 at 18:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.