The work-around for this issue is to move your certificates elsewhere within your home directory and create a ~/.cisco directory in another branch of the file system that is writeable to your user id. In these cases where An圜onnect needs to write to ~/.cisco/ but cannot, the connection attempt will fail. However, in many Linux distributions the NetworkManager service is started with read-only access to the entire /home directory structure using the ProtectHome=read-only configuration from systemd. Similarly, An圜onnect may download data from the VPN server during the connection attempt and if so, this downloaded data is also written to the ~/.cisco/ directory.

Your NetworkManager must be started by systemd using ProtectHome=read-onlyĪs outlined in the An圜onnect Manual, certificates must live in the ~/.cisco/ directory.

Your An圜onnect gateway needs to be configured to require downloading data to VPN clients.

Whether you hit this problem will depend on two things being true: Configuration is very simple, since you have your certificates set up already you just need to choose the VPN gateway to connect to from the drop down list and give your VPN connection a name. Select this option to configure your VPN and you will be presented with the configuration screen (shown below). Once successfully set up and with NetworkManager-anyconnect installed on your system, you should see a Cisco An圜onnect option when adding a new VPN connection. Set up your certificates and connection using the proprietary client and test your connection. Since NetworkManager-anyconnect provides a wrapper around the An圜onnect client, you should ensure that you can first connect via An圜onnect. It extends NetworkManager in a similar way to other VPN plugins and provides a wrapper to the proprietary Cisco An圜onnect VPN client.

NetworkManager-anyconnect is a VPN plugin for NetworkManager.

What is anyconnect vpn