Related guides

Does Cisco AnyConnect Work in China?

Updated 2026-10-07

Yes, it works. AnyConnect is Cisco’s enterprise VPN protocol; companies worldwide depend on it for remote work, and the chance of it being banned outright in mainland China is low. What does get blocked is an individual server address, not the protocol. So the real question is whether your provider has enough addresses and replaces them fast enough. Below: why it holds up, illustrated install steps for each system, how to troubleshoot, and how to update the client.

Why AnyConnect survives blocking better than proprietary VPN apps

AnyConnect traffic is standard TLS; from the outside it looks like a visit to an HTTPS website. It is the default for corporate intranets, and foreign companies’ offices in China use it every day, so blocking it wholesale is expensive.

Proprietary VPN apps have the opposite problem: their protocol is their own, its fingerprint is fixed, and once it is recognised the whole app stops working — and the app itself gets pulled from stores. The AnyConnect client is published by Cisco, and the open-source alternative OpenConnect exists for Windows, macOS, Linux, iOS and Android, so the client layer cannot be taken away.

What gets blocked is a server address. When one is flagged, that machine becomes unreachable and the others are unaffected. LeoTun runs its own machines in 24 regions; a flagged address is replaced with a new one, the domain updates automatically, and the address saved in your client stays the same.

Step by step, with screenshots

Pick your system and follow the screenshots. The button on the right plays the video, and any screenshot enlarges when you click it.

1
Open the website and click Cisco in the navigation bar.
2
Scroll down to Cisco Secure Client and click the Windows button to download the installer.
3
Open the downloaded installer, accept the license, and click Next to start installing.
4
Click Yes when Windows asks for permission.
5
Wait for the installation to finish, then click Finish.
6
Search for Cisco in the Start menu and open Cisco Secure Client.
7
With the client open, go back to the website and click the flag of the region you want. The server address is copied automatically.
8
Right-click the client's address box and choose Paste.
9
Click Connect.
10
Enter the account and password you registered on our website, then click OK.
11
After a few seconds, a notice shows you are connected.
12
Open YouTube to check. It loads normally, so the setup works.

Notes

Windows 7 and 8 can only use version 4.9, the last one that supports them.
AnyConnect needs no certificate file and no configuration import; the same username and password work on every device.
To confirm the exit after connecting, open an IP-lookup page and check that it shows the region you chose.

When it will not connect, check in this order

Try another region’s address. This is the fastest test: if another region connects, that one server is temporarily unreachable — wait a few minutes or use another region.
Change networks. If home broadband fails, try mobile data once, and vice versa. Blocking often differs between carriers.
Read the client’s error. “Login failed” means wrong credentials or an expired account; “Untrusted server certificate” usually means the system clock is wrong or the current network is intercepting TLS — switch networks; only “Connection attempt has failed” means the address is unreachable.
Update the client to the latest version. Compatibility problems in old versions show up as connection failures, especially after a major OS upgrade.
If none of that works, switch connection method. The same account can use OpenVPN or Hiddify to reach the same servers, and blocking of the three protocols is independent.

Updating Cisco AnyConnect

Cisco renamed AnyConnect to Cisco Secure Client; features and usage are unchanged. You do not need to uninstall first: install the new version over the old one and it keeps your saved server addresses.

Windows 10 and later and macOS use the 5.x line; Windows 7 and 8 stay on 4.9, the final version for those systems. On phones, update through the App Store or Google Play.

If the app store in your region does not list Cisco Secure Client, use the open-source OpenConnect client instead — same protocol, same username and password.

FAQ

Is AnyConnect legitimate enterprise software in China?

AnyConnect is Cisco’s remote-access software for businesses. Companies worldwide use it to reach their intranets, including foreign companies’ branches in mainland China. It is standard commercial software available from Cisco and the app stores.

Is a slow connection a sign of throttling?

Start by picking a green-light region or switching connection method: LeoTun’s region list shows a red/yellow/green light for each region’s current load. If it is still slow, the usual cause is the local broadband — shared community broadband, or a carrier and region that do not match: China Unicom in the north should pick Japan or Korea, China Telecom in the south Southeast Asia or Australia, and other broadband a China-region server. Then check whether only one app is slow.

Why does the same address connect sometimes and fail other times?

The address is a domain name, and the machine behind it changes automatically with blocking and load. The address you see stays the same while the server behind it has been swapped. If it fails, wait a minute or two and retry; that is usually the switch in progress.

AnyConnect, OpenVPN or Hiddify — which should I use?

AnyConnect is the least effort: a mature client and no configuration import. OpenVPN suits routers and Linux servers. Hiddify uses the hysteria2 protocol and performs best on networks with heavy packet loss. Three methods on one account; there is always one that suits your network.

Will a long session disconnect on its own?

AnyConnect itself does not disconnect on a timer. When the account expires the server ends the session; reconnect after renewing.