Troubleshoot Secure Access Error "The VPN Connection Was Started by a Remote Desktop User Whose Remote Console Has Been Disconnected"

Introduction

This document describes how to fix the error: "The VPN connection was started by a remote desktop user whose remote console has been disconnected".

Problem

When a user tries to connect with RA-VPN (Remote Access VPN) to the Secure Access headend, the error is printed in the Cisco Secure Client notification popup:

• The VPN connection was started by a remote desktop user whose remote console has been disconnected. It is presumed the VPN routing configuration is responsible for the remote console disconnect. The VPN connection has been disconnected to allow the remote console to connect again. A remote desktop user must wait 90 seconds after VPN establishment before disconnecting the remote console to avoid this condition.

The mentioned error is generated when the user is connected via the RDP to the Windows PC, tries to connect to RA-VPN from the given PC, and Tunnel Mode in VPN Profile is set to Connect to Secure Access (default option) and source IP of the RDP connection is not added to Exceptions.

For Traffic Steering (Split Tunnel), you can configure a VPN profile to maintain a full tunnel connection to Secure Access or configure the profile to use a split tunnel connection to direct traffic through the VPN only if necessary.

1. For Tunnel Mode, choose either:
   • Connect to Secure Access to direct all traffic through the tunnel; or,
   • Bypass Secure Access to direct all traffic outside the tunnel.
2. Depending on your selection, you can Add Exceptions to steer traffic inside or outside the tunnel. You can enter comma-separated IPs, domains, and network spaces.

Solution

Navigate to the Cisco Secure Access Dashboard:

• Click on Connect > End User Connectivity 
• Click on Virtual Private Network
• Choose the profile that you want to modify and click Edit 

• Click on Traffic Steering (Split Tunnel) > Add Exceptions > + Add 

• Add your IP address from which you established the RDP connection

• Click on Save In Add Destinations window

Note: The IP address could be found from the output of cmd command netstat -an.; Note the IP address from which there is an established connection to the local IP address of the remote desktop to port 3389.

• Click Next after adding the exception:

• Click Save changes in the VPN profile:

Related Information

• Add VPN Profiles
• Secure Access UserGuide
• Cisco Technical Support & Downloads