Cisco – How to Upgrade Cisco AnyConnect

ciscocisco-asafirewall

So I am in the process of upgrading our Cisco AnyConnect client on our ASA from 3.1 to 4.4 for an upcoming ISE upgrade.

I've transferred the files to the ASA's flash, and we are ready to change the "anyconnect image XXXX" in the configuration.

Is there anything that will need to be done on user's computers? It's mostly people in the IT department that use AnyConnect from home when needed. Will the AnyConnect client on the user's computers simply pull the required files from the ASA?

Sorry if this is vague or not accurate, but I cannot seem to find the information I'm looking for, and this is my first time dabbling with this.

Best Answer

There are a few strategies to deploying AnyConnect. The Cisco AnyConnect Secure Mobility Client Administrator Guide, Release 4.4 describes them in detail including client prerequisites and configurations.

Deploying AnyConnect refers to installing, configuring, and upgrading the AnyConnect client and its related files.

The Cisco AnyConnect Secure Mobility Client can be deployed to remote users by the following methods:

Pre-Deploy—New installations and upgrades are done either by the end user, or by using an enterprise software management system (SMS).

Web-Deploy—The AnyConnect package is loaded on the headend, which is either an ASA or ISE server. When the user connects to an ASA or to ISE, AnyConnect is deployed to the client.

For new installations, the user connects to a headend to download the AnyConnect client. The client is either installed manually, or automatically (web-launch).

Updates are done by AnyConnect running on a system where AnyConnect is already installed, or by directing the user to the ASA clientless portal.

Related Solutions

Cisco – upgrade RAM on a Cisco ASA 5520

Assuming it's a real 5520 and not a fake that's actually a converted 5510 (yep, a bunch of those were floating around - you'll know it by the fact it's only got a single RAM slot) you'll want PC3200 with CAS latency (CL) of 3 running at 400MT/s, unbuffered, ECC.

Not sure if the ASAs are also picky about the chip arrangement too, so if you want to play it super safe, make sure the RAM you buy has the memory spread across 8 chips.

Cisco – Migrating from PIX/VPN 3000 to ASA

Regarding question 1 on mobile device licensing

Per your comment below, I did a couple tests on our ASA5525-X which has Essentials/Mobile licenses. I was indeed able to limit access using Dynamic Access Policies. I setup a test policy allowing only iOS devices on iPad2,7 models to connect in a new policy. Then I setup the default policy to terminate sessions. This worked and allowed my Verizon iPad Mini to connect but not my iPhone. Here is the license breakdown:

Session Type: AnyConnect

Username     : <user>                 Index        : 40
Assigned IP  : 10.10.121.1            Public IP    : 70.194.2.165
Protocol     : AnyConnect-Parent SSL-Tunnel DTLS-Tunnel
License      : AnyConnect Essentials, AnyConnect for Mobile
Encryption   : AnyConnect-Parent: (1)none  SSL-Tunnel: (1)RC4  DTLS-Tunnel: (1)AES128
Hashing      : AnyConnect-Parent: (1)none  SSL-Tunnel: (1)SHA1  DTLS-Tunnel: (1)SHA1
Bytes Tx     : 3200                   Bytes Rx     : 940
Group Policy : anyconnect-split-policy
Tunnel Group : anyconnect-split-group
Login Time   : 11:46:24 EDT Fri Jun 7 2013
Duration     : 0h:01m:52s
Inactivity   : 0h:00m:00s
NAC Result   : Unknown
VLAN Mapping : N/A                    VLAN         : none

Note: When configuring these settings, if you don't have the "Apply" button highlight afterwards, you will need to do something in ASDM that will activate the button and allow you to click it. None of the DAP settings for AnyConnect specifics would apply automatically nor trigger the Apply button so I could apply the settings. I had to go modify another setting, click apply, modify the setting back, click apply. This was using ASDM 7.1 on a 9.1.2 ASA5525-X.

Regarding question 2 on the licensing:

There are no client-side licensing options that I am aware of. The only license not necessarily tied to the ASA directly is the AnyConnect Premium which may be pulled off of a "server" ASA with a pool of session licenses for multiple "client" ASAs. In the end, they're applied to an ASA still.

Source:http://www.cisco.com/en/US/docs/security/asa/asa91/license/license_management/license.html

Best Answer

Related Solutions

Cisco – upgrade RAM on a Cisco ASA 5520

Cisco – Migrating from PIX/VPN 3000 to ASA

Related Topic