Different Cisco agent versions on FTD and ISE

[Da ICS16]

Dear Community,

Current we are using Cisco AnyConnect version 4.x on both ISE and FTD.

We are planning to upgrade to Cisco Secure Client agent version 5.x

In case we change configuration on ISE Client Provisioning Policy only.

Mean on FTD, still keep using old Cisco AnyConnect 4.x (FTD as the VPN).

Is it working or not for endpoint PC using new Secure Client agent (LAN dot1x) but some times using VPN ( install AnyConnect agent 4.x on FTD site)?

Can we create both configuration for AnyConnect 4. and Secure Client v5 on FTD site?

Kindly share good practice and advise.

Best Regards, 

[Rob Ingram]

@Da ICS16 if the client application is upgraded to Secure Client 5.0 you can still connect to the FTD VPN without a problem. Although there is no reason why you cannot upload the Secure Client 5.0 headend package to the FTD aswell to align the software version.

[Pulkit Mittal]

I do not think their would be any issue, you can simply upload the latest client to headend which will populate the secure client to the endpoints with latest version on new connection if not upgraded already. I do strongly suggest to follow the guide.

https://www.cisco.com/c/en/us/td/docs/security/vpn_client/anyconnect/Cisco-Secure-Client-5/admin/guide/b-cisco-secure-client-admin-guide-5-0/deploy-anyconnect.html#ID-1425-000003d1

If you find this useful, then please mark it helpful and accept the solution.