Restrict Updated AnyConnect client to specific Connection Profile

[Jean Bourassa]

Does anyone know of a way that I can put an updated AnyConnect package on the ASA and prevent it from deploying to certain Connection Profiles or Group Policies?  I want to deploy AnyConnect 4 by putting it on the ASA and letting it roll out to the clients but I would like to deploy it to some specific groups first before it goes out to everyone.  Thanks!

[Marvin Rhoads]

I don't believe you can do that with the ASA as the package deployment point. When a remote access client connects, it will detect that there is a newer package on the ASA and attempt to download and install it.

If you pre-deploy (using the msi files or an enterprise endpoint software deployment tool), a client with a newer AnyConnect can access an ASA with only the older packages installed on it.

[Jean Bourassa]

Marvin, thanks for the response.  I was pretty sure that was the response I would get.  I have been working with the ASA and AnyConnect for over 5 years now and I never found a way to accomplish this.  Posting out here was a long shot but it was worth a try.  Thanks again!