topic Re: Cisco AnyConnect NAM with profile editor in Network Access Control

Cisco AnyConnect NAM with profile editor

kamarale — Mon, 11 Mar 2019 02:17:29 GMT

Hello,I´m trying to use the anyconnect NAM with also the anyconnect profile editor for 802.1x
I created a profile (.xml) with the editor but I don´t know how to apply it to a client(anyconnect).
If anyone can give me some instructons I would appreciate it.

Thanks in advance.
Regards.

Cisco AnyConnect NAM with profile editor

Tarik Admani — Wed, 11 Jul 2012 14:24:39 GMT

You will have to use a centralize software management solution in order to get this file out and in the proper location.

Thanks,

Tarik Admani

Cisco AnyConnect NAM with profile editor

kamarale — Wed, 11 Jul 2012 16:39:59 GMT

Isn´t it enough with the anyconnect NAM and the profile editor? What do you mean with "centralize software management solution" ?

Thanks.

Cisco AnyConnect NAM with profile editor

Tarik Admani — Wed, 11 Jul 2012 16:42:11 GMT

To build the profile yes, however you need to push these files to all your clients and you need to distribute this xml to the rest of your organization.

For doing some testing you can modify the current xml that the profile editor is on and save and even some cases restart the machine for new changes to take effect. Which xml file are you modifying?

Thanks,

tarik Admani

Re: Cisco AnyConnect NAM with profile editor

Amjad Abdullah — Wed, 11 Jul 2012 17:31:24 GMT

i hope this link is useful, it illustrates everything:

https://supportforums.cisco.com/docs/DOC-23117

Install and run the standalone profile editor (your second download); you only need the Network Access Manager component

a. Once installed, open the profile editor and configure a new profile, e.g. allow EAP types, disable Wired port management, etc.

b. File / Save as...

c. Name the file configuration.xml. This naming convention is required

d. Save the configuration file to the //Profiles/nam folder

3. Run the main Secure Mobility Client setup installer (setup.exe) from . This installs the AnyConnect framework and modules. Select the Network Access Manager modules. No other modules are necessary or required for managing wireless networks

Amjad

Re: Cisco AnyConnect NAM with profile editor

kamarale — Wed, 11 Jul 2012 20:16:01 GMT

Thanks Amjad.

Regards.

Re: Cisco AnyConnect NAM with profile editor

RolandoCasinillo14752 — Mon, 26 Apr 2021 12:41:43 GMT

Please me give me link to download nam profile editor. tnx.

Re: Cisco AnyConnect NAM with profile editor

Mike.Cifelli — Mon, 26 Apr 2021 13:24:50 GMT

Software Download - Cisco Systems

Profile Editor (Windows)

tools-anyconnect-win-4.10.00093-profileeditor-k9.msi

FYSA: default install location on windows = C:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client\Network Access Manager

Re: Cisco AnyConnect NAM with profile editor

Andrii Oliinyk — Mon, 04 Oct 2021 18:19:55 GMT

Hi Mike

i ran of my feet fighting failure to save customized configuration.xml in NewConfigFiles ending with Unable to sign & write file.

If i save config in different location & then copy it to NewConfigFiles & then restart AC file gets renamed into configuration_bad.xml. Editor is 4.10.

Parsing DART logs shows:

16: DESKTOP-36ABVFG: Oct 04 2021 19:22:09.471 -0100: %NAM-3-ERROR_MSG: %[tid=5308]: The configuration is invalid and will be ignored. Error: "allowUnauthPacProvisioning" tag is required.
....
19: DESKTOP-36ABVFG: Oct 04 2021 19:22:09.477 -0100: %NAM-6-INFO_MSG: %[tid=5308]: Invalid development version of configuration file.

....

& yeah there is no option "If using PACs, allow unauthenticated PAC provisioning" in editor 4.10 (& i havnt other)

Re: Cisco AnyConnect NAM with profile editor

Mike.Cifelli — Mon, 04 Oct 2021 18:50:00 GMT

@Andrii Oliinyk

If i save config in different location & then copy it to NewConfigFiles & then restart AC file gets renamed into configuration_bad.xml. Editor is 4.10.

-This typically means that something is goofed in the xml file based on what you configured. Hence why it gets renamed to configuration_bad.xml. My suggestion would be to try replacing the configuration.xml with your new one under the main location on 1 test client: C:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client\Network Access Manager\system

If you get the same error try recreating a new xml profile and focus on your settings. HTH!

Re: Cisco AnyConnect NAM with profile editor

Andrii Oliinyk — Mon, 04 Oct 2021 19:23:10 GMT

hi Mike

it ends in the same manner: configuration.xml gets renamed into *_bad.xml with the same error:

13: DESKTOP-36ABVFG: Oct 04 2021 18:37:30.145 -0100: %NAM-6-INFO_MSG: %[tid=33044]: Invalid development version of configuration file.
15: DESKTOP-36ABVFG: Oct 04 2021 18:37:30.148 -0100: %NAM-4-WARNING_MSG: %[tid=33044]: The configuration is invalid and will be ignored. Error: User Configuration (C:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client\Network Access Manager\system\/userConfiguration.xml) file not found - only user configuration will be ignored.
...

it looks like NAM is not happy with absence of mentioned above option, but editor dosnt have it in the place where it should be...

Re: Cisco AnyConnect NAM with profile editor

Andrii Oliinyk — Mon, 04 Oct 2021 19:34:05 GMT

now i'm sure the absence of "allowUnauthPacProvisioning" is a root cause: i unchecked "use PACs" & after that profile has been consumed by NAM.

wth.? why "if use PACs allowUnauthPacProvisioning" is absent in the editor?