I believe mlapeyre is correct that people are not understanding his issue 🙂
Cisco VPN clients work perfectly with captive portal turned off.
The issue is that the captive portal authenticator, once the VPN is connected, cannot communicate with ZS.
This issue is caused by the Cisco VPN client restricting access to the local network – ZS then disconnects the user after a few minutes because the authenticator hasn’t called home.
There is no way around this other than having the user change a setting in the cisco VPN client AND their network admin allowing them to make that change.
Your only true solution is to turn off captive portal.
BUT – You can mask this problem by increasing the Authenticator Validity as high as possible, that way, the disconnects are not every minute, but every few hours – Enough that most people wont notice!
Its also possible (I dont know the specific protocols/ports used by Cisco VPN … so i may be wrong) that you can allow VPN access as “Free Authorized”. This should allow the VPN to stay connected…