Troubleshoot Secure Access Error "Login Denied. Your Environment Does Not Meet the Access Criteria Defined by Your Administrator"

Introduction

This document describes a way to resolve the error "Login denied. Your environment does not meet the access criteria defined by your administrator".

Problem

When a user tries to connect with RA-VPN (Remote Access VPN) to the Secure Access headend, the error is printed in the Cisco Secure Client notification popup:

Login denied. Your environment does not meet the access criteria defined by your administrator

Cisco Secure Client error

The reason behind this error is that the end client PC does not meet the VPN posture conditions defined in the Secure Access dashboard.
If connecting to the Secure Access headend was possible from the same PC in the past, there is a possibility that some posture conditions changed over time.
For example, antivirus was disabled, or a given process is not running on the system anymore.

Solution

To fix this connection error, please make sure that the PC meets the Connect Time Posture Profile that is defined under the VPN Profile in the Secure Access Dashboard.

1. Locate the VPN Posture Profile name in the VPN Profile configuration:

VPN profile configuration

2. Verify the configuration of the VPN Posture Profile:

Posture profile configuration

3. Ensure that the PC you are trying to connect from is compliant with all conditions. Failing to meet either of the configured conditions would result in connection failure. 
In this example, the VPN Posture Profile enforces MAC OS, when the connection is attempted from a Windows PC.

To generate a full posture report from the client side, you can collect the DART bundle and look for the file called WaDiagnose.txt.

For further help with the investigation of this error, please open a TAC case and attach the collected DART bundle.

Related Information

• Secure Access User Guide
• How to collect DART bundle from Cisco Secure Client
• Technical Support & Documentation - Cisco Systems