topic Upgrade to Cisco Secure Client agent version 5 through ISE web portal in Network Access Control

Upgrade to Cisco Secure Client agent version 5 through ISE web portal

Da ICS16 — Thu, 22 Feb 2024 16:04:05 GMT

Dear Community,

We plan to upgrade AnyConnect agent version 4.xx to new Secure Client agent 5.xx through ISE server web portal.

There have around 7K endpoints PC using AnyConnect 4.XX

Could you share good practice how to push upgrade new Secure Client agent from ISE server?

1. Does ISE can push upgrade agent 300 PCs per time? if yes, how to do it?

2. Does ISE can push upgrade new agents to all PCs at the same time? if yes, how to do it?

3. In case #2 failed, how to restore existing PC ( using AC 4.XX ) still working fine?

Remark: We use ISE 3.1 P6

Well appreciated for your supporting.

Best Regards,

Re: Upgrade to Cisco Secure Client agent version 5 through ISE web por

Arne Bier — Wed, 28 Feb 2024 23:38:56 GMT

ISE does not push AnyConnect or Secure Endpoint software to endpoints. That is the job of the ASA/FTD when users make a connection to those firewall devices.

Re: Upgrade to Cisco Secure Client agent version 5 through ISE web por

rezaalikhani — Thu, 29 Feb 2024 08:33:18 GMT

@Arne Bier This question comes from the following statements from official Cisco's book:

Re: Upgrade to Cisco Secure Client agent version 5 through ISE web por

ahollifield — Thu, 29 Feb 2024 14:28:58 GMT

Yes only if your endpoints are actually using CPP flows. Do all of your endpoints use Posture or BYOD flows?

Re: Upgrade to Cisco Secure Client agent version 5 through ISE web por

Marvin Rhoads — Thu, 29 Feb 2024 14:41:09 GMT

As @ahollifield mentioned, the statement you highlighted only applies in a few ISE use cases. Generally, we depend on either an enterprise software management tool or, where VPN is widely used, the headend firewall to deploy new Secure Client versions.

If we are doing ISE posture, it CAN be used to deploy the modules but you should take care to sync what is being pushed from your VPN headend to avoid the systems conflicting with each other.

Re: Upgrade to Cisco Secure Client agent version 5 through ISE web por

Da ICS16 — Thu, 07 Mar 2024 08:21:45 GMT

Dear @ahollifield ,

We use Posture flow.

Thanks,

Re: Upgrade to Cisco Secure Client agent version 5 through ISE web por

Da ICS16 — Mon, 18 Mar 2024 15:41:37 GMT

Dear @ahollifield ,

We use posture less.

Let me know if you recommend on this.

Thanks.

Re: Upgrade to Cisco Secure Client agent version 5 through ISE web por

Da ICS16 — Mon, 18 Mar 2024 15:44:18 GMT

Dear @Marvin Rhoads ,

Do all endpoints require have connection both ( dot1x or VPN connection ) to upgrade to new agents?

Thanks,

Re: Upgrade to Cisco Secure Client agent version 5 through ISE web por

ahollifield — Mon, 18 Mar 2024 15:51:58 GMT

"Posture Less" What does this mean? Earlier you said you use Posture Flow?

Re: Upgrade to Cisco Secure Client agent version 5 through ISE web por

ahollifield — Mon, 18 Mar 2024 15:53:48 GMT

For VPN you would upgrade from headend instead. The endpoints must be in a flow that uses a Client Provisioning Portal. 802.1X or VPN alone is not enough to push new Cisco Secure Client packages/versions.