Anyconnect users different pkg file

[manvik]

Is it possible to use two different versions of Anyconnect client for different VPN users.

We are planning to upgrade the anyconnect client version, before rolling it out for entire users, needed to check for 2 or 3 users.

Can the new Anyconnect pkg file uploaded to ASA via ASDM, 
then few VPN users when logged should connect to new pkg file. 
This way their anyconnect version gets automatically upgraded.

ASA in the backend is configured to AAA ISE server then to AD.

Any steps via ASDM very much helpful.

[Rob Ingram]

@manvik Just use the pre-deployment package and manually install the software on the computers of the users you wish to use the different anyconnect version.

[manvik]

There are 3000 users, manually installing not possible.

[Rob Ingram]

@manvik I thought you said you wanted to check for 2-3 users before rolling out? I was suggesting you pre-deploy to those users for testing.

When you upload the headend package to the ASA/FTD all users will automatically upgrade (unless their local configuration file bypasses the downloader).

So perform the testing by manually upgrading the 2-3 users, then when ready to rollout you'd have to upload the headend package to the ASA or pre-deploy using your software management solution, such as SCCM.

[manvik]

Thank you @Rob Ingram we had tested manually with 2 users. It's working fine. 
Before rolling out to entire users just needed to check on automatic installation too, whether it works fine.

Should the headend package (.pkg file) be uploaded to Remote Access VPN > Network Client Access > Anyconnect client software

[Rob Ingram]

@manvik ok. Yes, upload the headend package file, guide - https://community.cisco.com/t5/security-knowledge-base/how-to-update-the-anyconnect-and-hostscan-images/ta-p/3157306

All clients will automatically upgrade by default next time they attempt to login. You can bypass the downloader updates by modifying the local policy on the client devices, but that would be a lot of effort. If you needed to phase this, then you'd have to use a software management solution (SCCM) to roll it out to different sets of users.

[tvotna]

Actually, "AnyConnect Deferred Update" feature can help here. It's a headend feature -- no need to tweak client-side preferences. Users can be educated to postpone update or launch it.

Another option is to distribute another AnyConnect profile to most users with <AutoUpdate UserControllable="false">false</AutoUpdate> to prevent them from upgrading all at once.

[Aref Alsouqi]

Make sure you remove the old package, or put down the list on the packages order andplace the new one on the top.