ASA Client-Update

Jim Thomas — Mon, 11 Mar 2019 16:43:18 GMT

If using the client-update for an ASA 5505 then is this truly an automatic update at the time of tunnel establishment? Will the asa automatically change the boot system and asdm commands and reload ? I also see that its just not the ASA 5505 supported but all the ASAs and the PIX product lines yet documentation states only ASA 5505s can be easy VPN remotes?

thanks

Jim

Re: ASA Client-Update

Kent Heide — Thu, 26 Nov 2009 21:50:42 GMT

The client-update feature is for updating the ipsec client upon connection. Not for upgrading the ASA 🙂

Here is an example:

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a008097ca6f.shtml

Re: ASA Client-Update

Jim Thomas — Fri, 27 Nov 2009 00:00:23 GMT

hmmmm I have documents showing it does upgrade the ASA like the old 3002 did as well. Here is the command description found here (http://www.cisco.com/en/US/docs/security/asa/asa82/command/reference/c4.html#wp2128844):

client-update

To issue a client-update for all active remote VPN software and hardware clients and adaptive security appliances configured as Auto Update clients, on all tunnel-groups or for a particular tunnel group, use the client-update command in privileged EXEC mode.

To configure and change client-update parameters at the global level, including VPN software and hardware clients and adaptive security appliances configured as Auto Update clients, use the client-update command in global configuration mode.

To configure and change client-update tunnel-group IPSec-attributes parameters for VPN software and hardware clients, use the client-update command in tunnel-group ipsec-attributes configuration mode.

If the client is already running a software version on the list of revision numbers, it does not need to update its software. If the client is not running a software version on the list, it should update.

To disable a client update, use the no form of this command.

Global configuration mode command:

client-update {enable | component {asdm | image} | device-id dev_string |
family family_name | type type} url url-string rev-nums rev-nums}

no client-update {enable | component {asdm | image} | device-id dev_string |
family family_name | type type} url url-string rev-nums rev-nums}

Tunnel-group ipsec-attributes mode command:

client-update type type url url-string rev-nums rev-nums

no client-update type type url url-string rev-nums rev-nums

Privileged EXEC mode command:

client-update {all | tunnel-group}

no client-update tunnel-group

Syntax Description


all	(Available only in privileged EXEC mode.) Applies the action to all active remote clients in all tunnel groups. You cannot use the keyword all with the no form of the command.
component {asdm \| image}	The software component for adaptive security appliances configured as Auto Update clients.
device-id dev_string	If the Auto Update client is configured to identify itself with a unique string, specify the same string that the client uses. The maximum length is 63 characters.
enable	(Available only in global configuration mode). Enables remote client software updates.
family family_name	If the Auto Update client is configured to identify itself by device family, specify the same device family that the client uses. It can be asa, pix, or a text string with a maximum length of 7 characters.
rev-nums rev-nums	(Not available in privileged EXEC mode.) Specifies the software or firmware images for this client. For Windows, WIN9X, WinNT, and vpn3002 clients, enter up to 4, in any order, separated by commas. For adaptive security appliances, only one is allowed. The maximum length of the string is 127 characters.
tunnel-group	(Available only in privileged EXEC mode.) Specifies the name of a valid tunnel-group for remote client update.
type type	(Not available in privileged EXEC mode.) Specifies the operating systems of remote PCs or the type of adaptive security appliances (configured as Auto Update clients) to notify of a client update. The list comprises the following: •asa5505: Cisco 5505 Adaptive Security Appliance •asa5510: Cisco 5510 Adaptive Security Appliance •asa5520: Cisco 5520 Adaptive Security Appliance •asa5540: Cisco Adaptive Security Appliance •linux: A Linux client •mac: MAC OS X client •pix-515: Cisco PIX 515 Firewall •pix-515e: Cisco PIX 515E Firewall •pix-525: Cisco PIX 525 Firewall •pix-535: Cisco PIX 535 Firewall •Windows: all windows-based platforms •WIN9X: Windows 95, Windows 98, and Windows ME platforms •WinNT: Windows NT 4.0, Windows 2000, and Windows XP platforms •vpn3002: VPN 3002 hardware client •A text string of up to 15 characters
url url-string	(Not available in privileged EXEC mode.) Specifies the URL for the software/firmware image. This URL must point to a file appropriate for this client. The maximum string length is 255 characters.

topic ASA Client-Update in Network Security

ASA Client-Update

Re: ASA Client-Update

Re: ASA Client-Update

client-update

Syntax Description