VPN anyconnect inquiry

[itsec_team]

Dear All,

I have a question about Cisco AnyConnect. We are planing to upgrade the Anyconnect Client software to the latest version in our firewall, our worry is that the anyconnect mobility client will be outdated because we cannot configure the auto update enable on the firewall because the users do not have a admin rights on their local laptops. My question is, if we upgrade the Anyconnect client is there any possible issue if the user is not n sync with the version? let say the version of the Anyconnect client is  4.5.xx and the anyconnect mobility client is 3.0.xx. Please advise.

[Rahul Govindan]

Anyconnect upgrades does not require Admin rights on the client machine. To answer your question, Anyconnect 3.x will automatically try to upgrade during connection. To disable this, you would have to manually edit the Anyconnect Local Policy file and set the "Bypass Downloader <BypassDownloader>" attribute to true.

[itsec_team]

Thank you for your answer, We have tested it and the update to the client machine is not pushing through without Admin rights what we did it we disabled the auto update because the client machine which has older version is keep on trying to upgrade. if do not upgrade the client machine are we going to have issue on the future? what will be issues if we do not upgrade the client machine with the same version?

[arnert]

We have recently had issues with the VPN Downloader and are going use the Bypass downloader attribute on our SSL/TLS/DTLS ASA headends with client services disabled for our network. One ASA is using IKEv2 as the tunneling protocol, the question is. Can we disable the client services listener in this situation? I saw some where that Client Services is a requirement for IKEV2 Anyconnect client tunnels! Is this true?