AnyConnect on Apple Silicon and macOS Monterey

[McNaughtonA]

I had AnyConnect 4.10.03104 working fine on an Intel Mac running macOS 12. I just migrated to a new Apple Silicon Mac  and now AnyConnect won't connect and gives a posture assessment failed error:

I can't seem to find any log entries that help identify what's gone wrong. What should I be looking at?

It almost looks like it's an Apple Silicon issue. Could it be unique to the M1 Pro/Max models?

I see this within the dart bundle:

Diagnose error:
{
"error" : {
"errors" : [
{
"code" : -8,
"method" : "dispatcher.dispatch( wjIn, wjOut )",
"called_at" : "wa_api.cpp:1139",
"errors" : [
{
"returned_at" : "wa_api_dispatcher.cpp:129",
"code" : -8
}
]
}
],
"define" : "WAAPI_ERROR_COMPONENT_LICENSE_EXPIRED",
"description" : "Defines an error when a call is made to a component whose license has expired.",
"timestamp" : "1635979261",
"timing" : 0,
"code" : -8,
"method" : 60005
}
}

I don't believe our licensing will have expired. So, I think this is a red herring.

Thanks in advance.

[Mohammed al Baqari]

Hi,

Report this to TAC. Clearly there is a mismatch between Mac libraries and
CSD agent checks which is are failing to load. I have seen other issues
with ise posture check on Monterey.

**** please remember to rate useful posts

[Kasun Bandara]

Hi,

contact TAC support for this. seams like this is mismatching of required OS libraries.

rate this and mark as answer, if this solved your issue

[McNaughtonA]

I spotted this in an earlier release of AnyConnect, the first one to support Apple Silicon:

"Due to this dynamic adoption in supporting Apple Silicon (M1 chip), macOS endpoints, using AnyConnect 4.10.02086 or later (and either ISE Posture or HostScan), must also upgrade their Posture Compliance Modules accordingly."

Is this just referring to what's on the macOS endpoint or does HostScan and/or "Posture Compliance Modules" exist at the headend? Is HostScan something that is only at the headend???

My AnyConnect product owner had felt it wasn't necessary to update the headend at this time. It's on v4.9.x. We don't use ISE posturing [yet].