Cisco AnyConnect Secure Mobility Client Administrator Guide, Release 4.9 Americas Headquarters Cisco Systems, Inc. 170 West Tasman Drive San Jose, CA 95134-1706 USA http://www.cisco.com Tel: 408 526-4000 800 553-NETS (6387) Fax: 408 527-0883 THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS. THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY. The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB's public domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California. NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS" WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE. IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental. All printed copies and duplicate soft copies of this document are considered uncontrolled. See the current online version for the latest version. Cisco has more than 200 offices worldwide. Addresses and phone numbers are listed on the Cisco website at www.cisco.com/go/offices. Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: https://www.cisco.com/c/en/us/about/legal/trademarks.html. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1721R) © 2021 Cisco Systems, Inc. All rights reserved. CONTENTS CHAPTER 1 Deploy AnyConnect 1 Before You Begin Deployment 1 AnyConnect Deployment Overview 1 Preparing the Endpoint for AnyConnect 4 Using Mobile Broadband Cards with AnyConnect 4 Add the ASA to the List of Internet Explorer Trusted Sites on Windows 4 Block Proxy Changes in Internet Explorer 5 Configure How AnyConnect Treats Windows RDP Sessions 5 Configure How AnyConnect Treats Linux SSH Sessions 6 DES-Only SSL Encryption on Windows 7 Using NVM on Linux 7 Prerequisites to Build the AnyConnect Kernel Module 7 Package NVM with Prebuilt AnyConnect Linux Kernel Module 8 Predeploying AnyConnect 8 AnyConnect Module Executables for Predeploy and Web Deploy 10 Locations to Predeploy the AnyConnect Profiles 10 Guidelines for Cloning VMs With AnyConnect (Windows Only) 12 Predeploying AnyConnect Modules as Standalone Applications 13 Deploying Stand-Alone Modules with an SMS on Windows 13 Deploying AnyConnect Modules as Standalone Applications 13 User Installation of Stand-Alone Modules 13 Predeploying to Windows 14 Distributing AnyConnect Using the zip File 14 Contents of the AnyConnect zip File 15 Distributing AnyConnect Using an SMS 15 Windows Predeployment Security Options 17 Cisco AnyConnect Secure Mobility Client Administrator Guide, Release 4.9 iii Contents AnyConnect Module Installation and Removal Order on Windows 17 Predeploying to macOS 18 Install and Uninstall AnyConnect on macOS 18 Installing AnyConnect Modules on macOS as a Standalone Application 18 Restrict Applications on macOS 20 Predeploying to Linux 20 Installing Modules for Linux 20 Uninstalling Modules for Linux 20 Manually Installing/Uninstalling NVM on a Linux Device 21 Certificate Store for Server Certificate Verification 21 Manually Installing DART on a Linux Device 21 Web Deploying AnyConnect 22 Configuring Web Deployment on the ASA 23 Download the AnyConnect Package 23 Load the AnyConnect Package on the ASA 23 Enable Additional AnyConnect Modules 24 Create a Client Profile in ASDM 24 Configuring Web Deployment on ISE 25 Prepare AnyConnect Files for ISE Upload 26 Configure ISE to Deploy AnyConnect 26 Configuring Web Deployment on FTD 27 Updating AnyConnect Software and Profiles 29 Disabling AnyConnect Auto Update 30 Prompting Users to Download AnyConnect During WebLaunch 31 Allowing Users to Defer Upgrade 31 Set the Update Policy 34 Update Policy Overview 34 Authorized Server Update Policy Behavior 34 Unauthorized Server Update Policy Behavior 35 Update Policy Guidelines 36 Update Policy Example 36 AnyConnect Reference Information 37 Locations of User Preferences Files on the Local Computer 37 Port Used by AnyConnect 38 Cisco AnyConnect Secure Mobility Client Administrator Guide, Release 4.9 iv Contents CHAPTER 2 Customize and Localize the AnyConnect Client and Installer 39 Modify AnyConnect Installation Behavior 39 Disable Customer Experience Feedback 39 Modify Installation Behavior, Windows 40 Windows Installer Properties That Customize Client Installations 40 Windows Installer Properties for AnyConnect Modules 41 Import a Customized Installer Transform to the Adaptive Security Appliance 42 Localize the AnyConnect Installer Screens 44 Import a Localized Installer Transform to the Adaptive Security Applicance 44 Modify Installation Behavior, macOS 46 Customize Installer Behavior on macOS with ACTransforms.xml 46 Disable the Customer Experience Feedback Module 46 Modify Installation Behavior, Linux 47 Customizing Installer Behavior on Linux with ACTransform.xml 47 Enable DSCP Preservation 47 Set Public DHCP Server Route 48 Customize the AnyConnect GUI Text and Messages 48 Add or Edit the AnyConnect Text and Messages 50 Import Translation Tables to the Adaptive Security Appliance 52 Create Message Catalogs for Enterprise Deployment 53 Merge New Messages into a Customized Translation Table on the ASA 54 Select the Default Language for Windows on the Client 55 Create Custom Icons and Logos for the AnyConnect GUI 55 Replace AnyConnect GUI Components 56 AnyConnect Icons and Logos for Windows 57 AnyConnect Icons and Logos for Linux 60 AnyConnect Icons and Logos for macOS 62 Create and Upload an AnyConnect Client Help File 62 Write and Deploy Scripts 63 Write, Test, and Deploy Scripts 64 Configure the AnyConnect Profile for Scripting 65 Troubleshoot Scripts 65 Write and Deploy Custom Applications with the AnyConnect API 66 Cisco AnyConnect Secure Mobility Client Administrator Guide, Release 4.9 v Contents Use the AnyConnect CLI Commands 67 Launch the Client CLI Prompt 67 Use the Client CLI Commands 67 Prevent a Windows Popup Message When ASA Terminates a Session 69 Prepare AnyConnect Customizations and Localizations for ISE Deployment 70 Prepare an AnyConnect Localization Bundle 70 Prepare an AnyConnect Customization Bundle 72 CHAPTER 3 The AnyConnect Profile Editor 75 About the Profile Editor 75 Add a New Profile from ASDM 75 The AnyConnect VPN Profile 76 AnyConnect Profile Editor, Preferences (Part 1) 76 AnyConnect Profile Editor, Preferences (Part 2) 80 AnyConnect Profile Editor, Backup Servers 85 AnyConnect Profile Editor, Certificate Matching 86 AnyConnect Profile Editor, Certificate Enrollment 89 AnyConnect Profile Editor, Certificate Pin 90 Certificate Pinning Wizard 90 AnyConnect Profile Editor, Mobile Policy 91 AnyConnect Profile Editor, Server List 91 AnyConnect Profile Editor, Add/Edit a Server List 91 AnyConnect Profile Editor, Mobile Settings 93 NVM Profile Editor 95 The AnyConnect Local Policy 100 Local Policy Preferences 100 Change Local Policy Parameters Manually 100 Enable Local Policy Parameters in an MST File 101 CHAPTER 4 Configure VPN Access 103 Connect and Disconnect to a VPN 103 AnyConnect VPN Connectivity Options 103 Configure VPN Connection Servers 105 Automatically Start Windows VPN Connections Before Logon 106 Cisco AnyConnect Secure Mobility Client Administrator Guide, Release 4.9 vi Contents About Start Before Logon 106 Limitations on Start Before Logon 107 Configure Start Before Logon 107 Troubleshoot Start Before Logon 108 Automatically Start VPN Connections When AnyConnect Starts 109 Configure Start Before Logon (PLAP) on Windows Systems 109 Automatically Restart VPN Connections 109 Use Trusted Network Detection to Connect and Disconnect 110 About Trusted Network Detection 110 Guidelines for Trusted Network Detection 110 Configure Trusted Network Detection 111 Require VPN Connections Using Always-On 113 About Always-On VPN 113 Limitations of Always-On VPN 113 Guidelines for Always-On VPN 114 Configure Always-On VPN 114 Configure Always-On