Problem with automated downgrade

[patoberli]

Hello

I have an ASA which currently serves Anyconnect 2.4.x. I want now to test version 2.5.x, but each time I connect, it automatically tries to downgrade the newer version to the old one on the ASA.

How can I accomplish this, without braking the serving of the current 2.4.x release?

Thanks,

pato

[Jennifer Halim]

You can order the AnyConnect image in the ASA as you wish, and it will be checked from top to bottom, ie: from number 1 down.

Eg:

svc image <> 1

svc image <> 2

svc image <> 3

Here is the command reference for your ref:

http://www.cisco.com/en/US/docs/security/asa/asa82/command/reference/s8.html#wp1515211

So if you have placed version 2.5 with sequence number 1, and 2.4 with sequence number 2, it will download Anyconnect version 2.5 to your PC. However, it will also upgrade others who are running version 2.4 as well unless you say "no" when it asks if you would like to upgrade it.

Hope that helps.

[patoberli]

Thanks for your answer.

This so far does not really help me, because the user should not get a promt at all. He should simply stay at 2.4, until I make the switch on the asa.

On older Version, I beleive 2.1, this was working. The client never downgraded itself, if I manually installed a newer version on the client-pc.

Anybody else an idea how I can block the downgrade, without making the users aware that there is a new version?

[bravotom99 · Accepted solution]

Not sure if you ever found a solution to this but I just experienced this issue.  I found that if the VPNManifest.dat file is missing in C:\Documents and Settings\All Users\Application Data\Cisco\Cisco AnyConnect VPN Client, the gateway tries to downgrade the client.  Once I copied the file into the directory from another machine, it connects fine and does not downgrade.

[patoberli]

Wow thanks, that worked

For Windows Vista/7 users, you have to enable the "show hidden files" and also "show protected system file" to see the correct folder.

[bravotom99]

Also, if you open that VPNManifest.dat in notepad, it shows the version number of anyconnect. I installed 2.5 and copied over a 2.5 VPNManifest but I also tried it with a 2.4 VPNManifest and that resolved it as well.  Maybe someone else has some insight into what that file does and whether anything 'breaks' if you happen to be using an old VPNManifest.