Bypass Client Provisioning Policy when upgrade Cisco agent failed

[Da ICS16]

Dear Community,

We are planning to upgrade Cisco Any Connect agent 4.x to Secure Client 5.x

We will deploy new Secure Client 5.x through SCCM server ( purpose deploy 300 PCs per time ).

We want to ensure no any impact with all PCs are installed Any Connect 4.x even we scope deploy new agent phase by phase.

How could be done to ensure on ISE CPP no any impact to all endpoints?

- PCs are installed Anyconnect 4.x should work with ISE CPP which defined 4.x

- new PCs just upgrade to new Secure Client 5.x should work with ISE CPP which define 5.x

Remark: In case upgrade to new Secure Client agent failed. Do we have any bypass? to ensure no impact to PCs installed AnyConnect 4.x

Thanks,

[ahollifield]

You can add the failed PC(s) to a Endpoint Identity Group and then make sure that Endpoint Identity Group is not subject to the posture requirements/policy.  

Also - why not also push the updated Secure Client 5.0 packages from ISE?

[Da ICS16]

why not also push the updated Secure Client 5.0 packages from ISE?

- We have thousand on endpoint PCs. We have to mitigate the impact when perform upgrade to new agent version.

Our environments use SCCM to deploy any applications. So we need to deploy upgrade phase by phase.

Could you help to share best practice for this upgrade agent to ensure no any impact on ISE and client PCs?

How to push the updated Secure Client 5.0 packages from ISE?

Best regards,

[Aref Alsouqi]

I would recommend updating ISE packages with the right version before going with the client upgrades.

[Da ICS16]

Dear @Aref Alsouqi ,

Could you please recommend the suitable Secure Client version?

Note: We use ISE 3.1 and plan to test with Secure Client 5.0.04032

Thanks,

[ahollifield]

Why not Secure Client 5.1?

[Aref Alsouqi]

I would personally go with the latest compliance module which is supported on AnyConnect 4.3+ anyway.

Software Download - Cisco Systems