topic Re: ISE AnyConnect customization bundles? in Network Access Control

ISE AnyConnect customization bundles?

Dustin Anderson — Fri, 09 Sep 2016 18:59:18 GMT

Greetings,

I'm lost on trying to figure out how to do this, or if it's even possible. The 2 issues I have is installing through the web portal. We can manually install correctly, but not via the portal.

1) We don't want to install the VPN client. Through command line, we can do it via this command.

msiexec /package anyconnect-win-4.3.01095-pre-deploy-k9.msi /norestart /passive PRE_DEPLOY_DISABLE_VPN=1

2) The default config managed wired, we only want wireless managed.

I found a PDF on customization bundles, but it's vague on if or how to do this. I downoaded their samples, and that's not much more of a help.

Anyone done this?

Or is there a way to edit the pkg file uploaded to ISE?

Re: ISE AnyConnect customization bundles?

hslai — Wed, 14 Sep 2016 16:09:25 GMT

If I understand your questions correctly, you want to perform web deploy from ISE for AnyConnect ISE posture module and AnyConnect NAM module.

On 1, we may upload a XML file to disable VPN tile using the file attached.

On 2, we may download the AnyConnect profile editor at CCO, install it on a Windows admin PC, use it to create NAM profile.

Re: ISE AnyConnect customization bundles?

Dustin Anderson — Tue, 20 Sep 2016 22:10:04 GMT

ok, I have made a new configuration.xml, but I'm not sure how to get it to deploy with the install.

You can upload a customization bundle, but not sure what needs to be in it, and what the folder structure needs to be.

Re: ISE AnyConnect customization bundles?

hslai — Tue, 20 Sep 2016 22:24:20 GMT

We will upload each of the AnyConnect profiles individually. For example, below, taken from our ISE compliance lab guide, shows the steps to upload a NAM profile with a name 'anyconnect-NAM-EAP-FAST.xml'.

Click + Add then Agent Resources from local Disk from the drop-down list.

Category	Customer Created Packages
Type	AnyConnect Profile
Name	*acNAMProfile*
Description	Configure AnyConnect NAM for EAP-FAST.

Browse to C:\Users\Admin\Downloads\
Select anyconnect-NAM-EAP-FAST.xml
Click Submit to save changes. Confirm when prompted for SHA hash match.

After that, we will create an AnyConnect configuration for Windows clients to combine all the profiles.

...

* AnyConnect Package:	AnyConnectDesktopWindows 4.2.01037.0
* Configuration Name:	*acConfigWin*
Description:	AnyConnect agent configuration for Windows
* Compliance Module	Anyconnect-win-compliance-3.6.10294.2
AnyConnect Module Selection
ISE Posture VPN Network Access Manager Web Security ASA Posture Start Before Logon Diagnostic and Reporting Tool	✔ ✔ ✔
Profile Selection
ISE Posture VPN Network Access Manager Web Security Customer Feedback	acPostureWinProfile acVPNdisableProfile acNAMProfile - -

...

Then, create an ISE client provisioning rule to use the AnyConnect configuration. For example,

Rule Name	ID Groups	OS	Conditions	Results
...
Windows Employee	Any	Windows All	demoAD:ExternalGroups EQUALS demo.local/HCC/Groups/Employees	Agent Configuration Agent: acConfigWin
Windows Employee	Any	Windows All		Native Supplicant Configuration Config Wizard: WinSPWizard 1.0.0.51 Wizard Profile: Cisco-ISE-NSP

Re: ISE AnyConnect customization bundles?

Dustin Anderson — Tue, 20 Sep 2016 22:40:17 GMT

Thanks,

I did not realize I could upload the bare xml files like that.