topic Re: Running different version of AnyConnect, client automatically upda in Network Access Control

Running different version of AnyConnect, client automatically updating

Anthony O'Reilly — Thu, 07 Oct 2021 09:19:38 GMT

Hi,

I have the following scenario.

The policy rules are still in testing but when the laptop authenticates and is authorised successfully, it downloads the 4.10.02086 version of AnyConnect. I don't want this.

I want the laptops to have 4.8.03036 which is already installed and desktops to have 4.10.02086 which is already installed.

I don't want the laptop to upgrade the client from 4.8.03036 to 4.10.02086. I know this is an old version but it will be upgraded as part of another project.

Table below is a high level summary of what we are doing:

Device	Wireless/Wired	AnyConnect Version	Compliance Module	Policy	Identity Groups
Laptop	Wireless	4.8.03036	4.3.1453.6145	Use existing policy	None
Laptop	Wired	4.8.03036	4.3.1453.6145	Need new policy that looks at only laptops on the LAN that doesn't conflict with desktops	None
Desktop	Wired	4.10.02086	4.3.2336.6145	Need new policy that looks at desktops on the LAN and it doesn't conflict with laptops	None

Thanks

Anthony.

Re: Running different version of AnyConnect, client automatically upda

Mike.Cifelli — Thu, 07 Oct 2021 12:27:38 GMT

For this issue you need to test/focus on your CPP (client provisioning policies). You need to setup two separate ones (one for the 4.8 clients and one for the 4.10 clients). Also, create 2 separate AnyConnect Configuration profiles (Policy->Policy Elements->Results->Client Provisioning->Resources). Then assign each respective one as the result in the CPP. Ensure that the clients are steered to the proper one. This will eliminate the auto upgrade of the 4.8.x clients. HTH!

Re: Running different version of AnyConnect, client automatically upda

Milos_Jovanovic — Mon, 11 Oct 2021 06:34:04 GMT

Hi @Anthony O'Reilly,

Next to what @Mike.Cifelli mentioned, you could also add option on your existin Client Provisioning Configuration option to defer update. You would create new configuration, for new 4.10 version, and then activate defer option in order not to update clients with 4.8 version.

BR,

Milos

Re: Running different version of AnyConnect, client automatically upda

Anthony O'Reilly — Tue, 12 Oct 2021 15:52:51 GMT

Hi @Mike.Cifelli @Milos_Jovanovic I used two CCPs and two different AD groups and it worked a treat. As it turns out the laptop was in the desktop and laptop AD groups. All working as expected now.