AnyConnect 4.10 upgrade to Secure Client 5.x

[tachyon05]

I need to upgrade AnyConnect 4.10 because it is EOS on 3/31/24.  The replacement product is Secure Client 5.x.  Currently, users only have DART and NAM installed on their computers.

1. Do I need to uninstall AnyConnect 4.10 or is that automatically done when running the Secure Client installer?
2. We have a configuration.xml file that contains profiles and settings for existing wired and wireless networks.  Will the new Secure Client use the same XML file?  

[Marvin Rhoads · Accepted solution]

No uninstall is necessary when upgrading from AnyConnect 4.x to Secure Client 5.x

Your configuration files will be copied into the new folders specific to Secure Client 5. (Created automatically in the C:\ProgramData\Cisco\Cisco Secure Client folder in Windows).

[tachyon05]

Sounds like it is not a problem to have both the new and old clients.  Will Windows OS prefer and use only the new Secure 5.x over the old AnyConnect 4.x for 802.1x?

[Marvin Rhoads]

When you install Secure Client 5.x it will replace AnyConnect 4.x. The product name and folders used change but it is still just like an in-place upgrade in other respects.

[tachyon05]

Thank you.  My TAC person said the following for some reason.  I will try to get a test laptop and try it out.

[+] Cisco Secure Client will not get rid of the previous installations of AnyConnect, you will need to uninstall first then install Secure Client.

[+] You will need to migrate configuration of the profile to a 5.x version with the help of the profile editor. Here is the download link: https://software.cisco.com/download/home/286330811/type/282364313/release/5.0.05040

[Marvin Rhoads]

What the TAC told you doesn't match my experience. I have moved over a dozen customer organizations (with several thousand end users) and my own company's 100+ users to Secure Client 5 and none of them ever had to uninstall anything or migrate any configuration using the profile editor.

[tachyon05]

Thanks, and your experience is what I would expect, and hope Cisco provides to their customers.  Looking at the download site, I see the only 5.1 version out there is 5.1.0.136 which came out 2 weeks ago on 10/27/23.  There are several 5.0 versions with the latest being 5.0.05040 which released on 9/5/23.  There is no "safe harbor" or "star" version.  Would you be able to share which version you went with on your most recent upgrade and if there are any issues encountered?

[Marvin Rhoads]

On my personal laptop I have upgraded just about about every version and maintenance release since 3.x, including the latest 5.1. As of right now, 5.0 MR 5 (5.0.05040) would be the best choice for most customers. 5.1 is intended primarily to add the Zero Trust module with Duo desktop for Cisco + Secure Access customers.

Cisco doesn't publish a "Suggested Release" (Gold Star) for Secure Client, but they generally recommend the latest maintenance release in the most current version.

[tahscolony]

Hi Marvin. We run Anyconnect 4.10.08025 on a 5555-X using two different profiles, one for split tunnel and one full tunnel. We also use Windows, Mac and Linux clients. Reading the download for the clients, the MACs require Admin access to install. Also I found to use umbrella roaming a module needs to be installed from the ASA.

So two questions, are there any configuration changes required on the ASA in order to use the latest SC5?  We also upgrade via the ASA, so how will that impact the MAC users?

[j.a.m.e.s]

There are certain minimum ASA version requirements and flash memory requirements, but I don't think any configuration changes are generally required when going from v4.10 to v5.X.

You mentioned using web-deploy, so the equivalent to this config needs to be updated:

webvpn
  anyconnect image disk0:/anyconnect-xxxxx.pkg 1 regex "Windows NT"