“Encapsulating user TCP packets inside a SSL/TLS TCP tunnel causes TCP Meltdown when network loss occurs. Enabling DTLS switches the outer tunnel transport to UDP.”

During a remote workforce expansion for enterprise clients at Wipro, remote employees reported severe lag and dropped sessions when working over Cisco AnyConnect SSL VPNs.

Architecture: DTLS UDP 443 Tunnel Acceleration

Diagnosing packet captures revealed a classic TCP-in-TCP Meltdown. When packet loss occurred over public internet links, both the inner user TCP session and the outer SSL TLS VPN tunnel attempted retransmissions simultaneously, multiplying congestion.

We enabled Datagram Transport Layer Security (DTLS) on the Cisco ASA VPN gateway, allowing AnyConnect clients to establish an un-gated UDP 443 transport tunnel.

• Primary Transport (DTLS UDP 443): Handles 99% of user traffic without TCP-in-TCP windowing bottlenecks.
• Fallback Transport (TLS TCP 443): Automatically backs up traffic if strict corporate firewalls block outbound UDP 443 packets.

[!NOTE] Verify that perimeter firewalls permit outbound UDP port 443 in addition to standard TCP port 443 for Cisco AnyConnect headends.

# # Cisco ASA WebVPN AnyConnect DTLS Configuration
webvpn
 enable outside
 anyconnect-essentials
 anyconnect image disk0:/anyconnect-win-4.x.pkg 1
 anyconnect enable
 tunnel-group Corporate-VPN webvpn-attributes
  group-alias Corp-Access enable
  dtls enable

The Verdict

Key Takeaway

Enable DTLS UDP Tunneling on Cisco AnyConnect Remote Access Gateways.

Configuring DTLS over UDP 443 eliminates TCP retransmission loops, delivering 5x faster file transfers and voice quality over remote access VPN connections.