Cisco Secure Desktop, ActiveX not working, IE 10/IE11

[alig.norbert]

Hi there,

we noticed that the Cisco Secure Desktop / Hostscan is not working with Internet Explorer 10 on Windows7/Windows8.

As described here, the SSL VPN is/should working but no documentation about Cisco Secure Desktop / Hostscan.

http://www.cisco.com/en/US/docs/security/asa/compatibility/asa-vpn-compatibility.html#wp214704

It's a Cisco ASA5520 with the lates release.

- ASA Version 9.1(2)

- ASDM 7.1(3)

- Cisco Secure Desktop  csd_3.6.6249-k9.pkg

- Hostscan hostscan_3.1.03104-k9.pkg

Any ideas, hints out there?

Thanks a lot,

Norbert

[Javier Portuguez]

Hi,

It would be very helpful if you tell us what the issue is.

Your software information seems to be very nice, but you did not explain the issue.

Let us know, so we could proceed further.

Thanks,

[alig.norbert]

Hi,
It seems to work....
The problem was that the hostscan function (ActiveX) could not be loaded with IE10.
An hostscan upgrade solve it.

Greets,
Norbert

Sent from Cisco Technical Support iPhone App

[alig.norbert]

Hi all,

Still facing the ActiveX problem with IE10/11. The Cisco Secure Desktop is not loading as well. Adding the URL in the IE "compatibility view" help as workaround.

Is there some solutions?

Regards,
Norbert
 

[lknutsonuci]

I am seeing similar behavior. Hopefully what I'm seeing isn't drastically different, so as not to have hijacked your thread. (I hadn't keyed into the IE connection until you mentioned it, but once I check my logs, IE seems to be the common factor.)

Any of my VPN users with AnyConnect 3.1.3103 on Windows 7 (64-bit specifically) and IE 10 fail to pass my DAP policies. A virtually identical host with Windows 7 64-bit and IE 9 passes DAP. (I'm not performing any DAP check on IE at all.) After working on a little testing of my own, I intend to file a TAC case. If something interesting develops either in my testing or the TAC case, I'll update here.

[alig.norbert]

Hi Lee,
Have you tried debug dap trace on the ASA?

Sent from Cisco Technical Support iPhone App

[lknutsonuci]

Ironically, I have two bugs in one (which has added to the time to debug it). When I'm running debug dap trace on the ASA, the debug results are truncated on Windows 7, 64-bit hosts (regardless of IE version). Somewhere in the middle of the endpoint.os.hotfix output, the client just stops logging DAP information for no apparent reason, so I never get to see the relevant endpoint.fw, endpoint.av, and endpoint.as information I'm actually using in my DAP checks.