AnyConnect 4.x on ASA 8.4.x: AnyConnect is not enabled on the VPN server

I recently had to do a failover on a pair of ASA5520s. On failing over to the secondary, AnyConnect stopped working. I did not see a license error, but users who connected received this error:

AnyConnect is not enabled on the VPN server

There weren't any smoking guns in the logs. I did notice that the newest version of the config was missing the client image definitions in webvpn. They were in the flash drive, but not copied to the secondary. So, when the secondary took over, this portion of the config was dropped.

The solution was to re-add the images:

config t
webvpn
anyconnect image disk0:/anyconnect-macosx-i386-4.3.00748-k9.pkg 1

anyconnect image disk0:/anyconnect-win-4.3.00748-k9.pkg 2

Cisco ASA tftp Copies and Issues with atftpd

while attempting to copy a new anyconnect pkg file from a CentOS based server running atftpd, I received the following error on a Cisco ASA 5505:

%Error reading tftp://mytftpserver/anyconnect-win-3.1.14018-k9.pkg (Undefined error code)

On the tftp server in /var/log/messages, I saw:

Mar  6 14:49:19 mytftpserver  atftpd[15147]: Serving anyconnect-win-3.1.14018-k9.pkg to 192.168.47.5:32947

Mar  6 14:49:19 mytftpserver atftpd[15147]: Requested file to big, increase BLKSIZE

I had installed tftp a while ago... specifically atftp-server. After looking at the man page for in.tftpd, I concluded there was no good way to set BLKSIZE on this package. The fix was:

sudo yum erase atftp-server

sudo yum install tftp-server

I then edited the xinet.d/tftp file to enable it and change the target directory and restarted xinetd. After this, I was able to copy the pkg file over successfully.