AnyConnect - DART - duid is not unique per device

[Jerome BERTHIER]

Hi,

I'm looking for accurate documentation on how the AnyConnect duid is generated.

If I look at DART cli options, there is two ways to print the uid of a device :

-u, -udid
Display global unique device identifier information.

-ul, -udid_legacy
Display unique device identifier(legacy) information.

But It seems that it is NOT a unique device identifier on Linux systems.

I do retreive the same id on three differents devices under differents local users and differents Linux OS (Fedora 31, Ubuntu 18.04).

Those devices were not cloned. They were installed from scratch at differents dates.

Looking at this documentation, the udid should be unique.

https://www.cisco.com/c/en/us/td/docs/security/vpn_client/anyconnect/anyconnect48/administration/guide/b_AnyConnect_Administrator_Guide_4-8.pdf

An option to generate a new udid exists only for Windows.

So does anyone know how these ids are generated ?

It seems that it is not safe to use it under an authorize policy on the ASA.

I'm going to open a case about this issue.

Thank you

[Jerome BERTHIER · Accepted solution]

Hi

I reported the issue to the TAC this summer :

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvu65566

It has been fixed in version 4.9.01095 or later.

Deploying this release or later using auto update can set to a connection error once after upgrade :

https://www.cisco.com/c/en/us/td/docs/security/vpn_client/anyconnect/anyconnect49/release/notes/release-notes-anyconnect-4-9.html#Cisco_Reference.dita_f3e6b845-9e69-4679-b15a-abc9126d6dfb

Regards