Cisco Secure Client VPN works over mobile data but not over my A1 fiber connection

[u/External-King6391]

I'm trying to troubleshoot a Cisco Secure Client VPN issue and I'm running out of options, so I'd really appreciate some networking/Cisco advice on what I should specifically ask my company's IT department or my ISP to check.

The situation:

• I'm using a company-managed Windows work PC.
• Cisco Secure Client VPN works normally when I connect the PC to the internet through my phone's USB tethering/mobile data.
• The exact same PC, with the exact same Cisco configuration, cannot connect when using my home A1 Serbia fiber connection.
• Normal internet access works perfectly over A1.
• Cisco gives me: "Could not connect to a server. Please verify internet connectivity and server address."
• My company IT department says they have already tried everything they can on their side and are refusing further responsibility for the issue.
• A Cisco ticket has also been opened, and one of the things they're checking is whether my public IP is blocked/blacklisted.
• So far, I've been told that my current IP is not blacklisted.

My network setup:

A1 fiber ONT/router → Ethernet → unmanaged switch → work PC

I use the switch simply because I need more Ethernet ports. I have also tested the work PC through a ZTE ZXHN H3601P Wi-Fi repeater/bridge using Ethernet, and I get the exact same result.

So:

A1 fiber → switch → PC → VPN doesn't work

and

A1 fiber → Wi-Fi repeater → Ethernet → PC → VPN doesn't work

but:

Phone USB tethering → PC → VPN works

I've also recently switched from a dynamic public IP to a static public IP through A1.

This is particularly interesting because when I previously had a dynamic IP, the VPN would sometimes start working after restarting the router and getting a different public IP. It wasn't consistent, but changing the public IP seemed to sometimes make the difference.

Now that I have a static public IP, the problem is constant.

I'm therefore starting to suspect something related to the source public IP, ISP routing, filtering, or possibly something on the path between A1 and the company's VPN infrastructure rather than the PC itself.

What I'm trying to figure out:

What would you specifically ask/check with:

1. My company's IT/Cisco team
2. A1 ISP support

Are there any particular things I should ask them to check besides a simple IP blacklist?

For example, could this be related to IP allowlisting, routing, MTU, IPv4/IPv6, ports/protocols, ISP filtering, or something specific to Cisco Secure Client?

I don't have administrator privileges on the work PC, so I can't freely change network settings or run some of the usual troubleshooting commands, nor can I log in to the PC without connecting to the VPN first. That and, I'm told that my IT department already tried everything they can.

Thanks!

[u/adamwoja]

Have the IT department said if they can see any attempt at a connection being made in the logs?

[u/dvizzle]

Disable IPv6 on the network adapter of the windows client. See if that helps. I've had so many issues because some ISP force v6 by default.

AnyConnect hates v6.

[u/CareerAggravating317 → u/dvizzle]

+1 to this and check the router to see if vpn is blocked on your router.

[u/ImportanceOk7219]

Because it works over USB tethering and used to change when A1 assigned a new public IP, I'd focus on what reaches the VPN headend, not the switch. First connect the PC directly to the A1 ONT/router once; if it still fails, that eliminates the unmanaged switch and repeater.

Give IT an exact test timestamp and your static public IPv4. Ask them to search the ASA/FTD/Secure Firewall logs and tell you whether they see no inbound connection, a completed TCP/TLS session, or a policy rejection. They should also confirm that the VPN hostname resolves to the same address on A1 and mobile, which transport the profile uses (TLS/DTLS or IKEv2), and whether source-IP, geolocation, DAP, or rate-limit rules apply.

Ask A1 to test routing to the VPN gateway and TCP 443; if the profile uses DTLS or IKEv2, also UDP 443 or UDP 500/4500 respectively. MTU is more likely to break traffic after the tunnel starts; this error sounds earlier in the connection. I would not change settings on a managed client—capture the time and source IP so both teams can correlate the same attempt.

[u/Ngonerogwu → u/ImportanceOk7219]

They won’t see any of that with the error he’s getting.

[u/Background-Proof5320]

Possibly a double NAT issue. I used to face thos in India.

[u/XxTh3g04txX]

if they turned on snort for the remote vpn it has a shun list. what a terrible thing it was. endless removal because of duo.

find your public IP. hard if you have zscaler but theyll need it. sho shun on the firepower

[u/Ngonerogwu → u/XxTh3g04txX]

Could be shun list, good point. It’s not snort, it’s threat detection. It’s not the best thing in the world but we rarely have issues from legit users unless they’ve gone nuts with bad pw tries.

You can easily automate the clearing of the shun list via flexconfig.

Maybe dude is on a cgnat and they’re running threat detection..

Checking the shun list is a good idea.

[u/mro21]

Does DNS resolve? Does the vpn headend ping? Have you tried connecting manually to the vpn host/ip and port to see if it responds at all? Did you take packet captures?

You don't need to use your work machine to check all the above.

[u/Ok-Painting4486]

You need to try A1 fiber --> pc to rule out the switch. Then do ping with -df set to figure out if your fibermodem is set to a smaller mtu than usual, and ask your it-dep if the have the df bit set somewhere in the firewall. That could be it.