As of 4.7.01076 we believe this problem has been resolved. ... View more

I would suggest testing any feature upgrade of Windows.  We have had problems with each upgrade Microsoft releases.  This is a very difficult situation at this point because no one seems to be resolving the issue.  We have even had to completely re-image some machines because of this.  There doesn't appear to be any consistency to the failures either.   Right now I am working on a machine that we upgraded to 1803.  After upgrading to 1803, we uninstalled the existing Anyconnect, deleted all folders, then ran ccleaner to remove all registry entries associated with Anyconnect, then rebooted.  After the reboot, we ran an install script to install 4.6.01098 NAM, VPN, and Umbrella.  The install completed, then we rebooted.  The machine is failing to authenticate using the wired connection.  The wireless connection works as expected (Machine Auth).  After checking ISE to see why the wired connection wasn't working, I discovered ISE never saw an authentication attempt.  After logging into the switch and enabling authentication debugs, the switch isn't seeing any authentication packets from the supplicant.  Anyconnect has just decided to not work with the wired connection.  Works perfect with wireless.   These issues are really starting to drive a wedge into our attempt to implement end to end Cisco solutions. ... View more

We have just started testing Windows 1709 upgrades to our users and are experiencing the same problem.  Does anyone have any idea of a non-hack solution to make this work?  It seems like the provided solution requires a script to be run on the user machine to unbind the interface after the update.  If the update breaks the expected functionality and connectivity, how are we supposed to run the script after the update to apply the fix?  I don't believe it is feasible for us to manually perform this task or have users execute a local script that is staged on their machines before the update.  The majority of our users don't even have local administrative rights to their own machines which I suspect will be a problem if the answer is to have them run the script locally.   This issue has resulted in discussions calling for investigation of the Windows Supplicant to be used over NAM for dot1x authentication. ... View more

Marvin, Thanks for your response.  I had some of my acronyms mixed up.  We would like to be able to authenticate users via ISE and then authorize users by pushing dACLs.  I would also like to be able to auto-select the tunnel group (connection profile) for the user based on an AD group membership value. Logically in my mind I have the process mapped as follows: ASA passes authC to ISE ISE authZ response passes class selection back to ASA class selection matches a group policy which sets ACL Another question I have is about the configuration procedure for setting the Authentication method for a tunnel-group to both AAA and Certificate.  I can choose the Both radio button but can't figure out where I configure the certificate definition that the ASA and Anyconnect should use to determine that this machine is a corporate asset.  This would restrict only connections from a corporate supplied machine to be associated to this tunnel-group.  Could you provide any additional details on this?  Thanks. ... View more

I went through this process on Monday and still have not received an eDelivery email with a download instructions.  I did receive a Confirmation of Upgrade Order email though.  Why is this product handled differently than all others?  This should be available through the support downloads just like any other piece of software that I have a current contract on.   ... View more

Almost a year later and there is still not a way to download this product through the normal support mechanism. I am attempting to open a TAC case to get download information for CML 1.1 but I can't even open a case because the TAC New Support Case webpage has a problem when selecting CML from the product list.  There aren't any options for the Problem Area field which is a required field to open a case. Again, I state how disappointed I am in how this product has been handled from a support standpoint. ... View more

Any update on 1.1 release?  How are we going to be notified of this upgrade and how are we going to access the new OVA or upgrade packages? I know this is a v1 release, but we have been underwhelmed with the product since we picked it up early this year.  ASAv and l2 need to be implemented soon. ... View more

The only way I could resolve this was to uninstall all versions of JRE 8.  Apparently they can't both be installed to the environment, or there isn't a way to define which runtime you want to use for CML while having both environments installed.  I am running Java 7 Update 75 now. ... View more

David,   Thanks for the update.   Jonathan ... View more