Windows 11 (version 24H2) made a change to the API behavior that impacts wireless access and location. Specifically, access to APIs providing Basic Service Set Identifiers (BSSIDs) is now restricted and requires you to configure location services appropriately. You must go to Windows Settings > Privacy & Security > Location and set Location Services to On and then Let desktop apps access your location to On and then reboot to gain access. The following Secure Client modules that rely on BSSID information are impacted, and you should track the following caveats, as well as Microsoft updates, to ensure continued functionality:

• Network Access Manager: (CSCwm05134) When Network Access Manager is started while running Windows 11 24H2, you are prompted to enable location services.

• Network Visibility Module: (CSCwm87018) If the Location feature is disabled in Windows 11 24H2, the Network Visibility Module will not report the SSID details when connected to a wireless network.

• ISE Posture: (CSCwm80714) The discovery process for finding the ISE policy server will not occur in Windows 11 (24H2 and later) unless you enable Location Services as instructed above, or configure an ISE Posture Profile setting. If you set the Operate on non-802.1X wireless to Yes when the primary interface of the endpoint is wireless, you don't need to enable the Location Services. You will receive a notification in the ISE Posture tile if Location Services are not enabled.

• ThousandEyes: The ability to query information about the current WiFi connection, such as signal strength and noise, is hindered.

Note	Microsoft has indicated that they plan to add the ability to select desktop applications individually rather than the current allow-all approach.

Network Access Manager can use Single Sign On (SSO) credentials for network authentication when a user logs on with a username and password, or a certificate PIN. Microsoft introduced Windows Hello for Business (WHfB) as an additional way to log on, but WHfB SSO credentials cannot be used by Network Access Manager and are not currently supported. Because WHfB SSO credentials are not supported, you will be prompted for 802.1x authentication credentials after WHfB log on.

Due to a new OS requirement, one-time administrator privileges are necessary when performing a web deploy upgrade from 5.0.x (or earlier) to 5.1.x (or later). Further updates do not need them. You can circumvent this limitation by managing macOS devices via MDM and pre-approving the application.

With the deprecation of IE11, Secure Client embedded browser defaults to WebView2, as long as the runtime is installed. If you need to revert back to the legacy embedded browser control, add a DWORD registry value UseLegacyEmbeddedBrowser set to 1 to the following Windows registry key:

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Cisco\Cisco Secure Client

Encrypted Domain Name System (DNS) resolution impacts Secure Client functionality, namely that network flows targeting FQDNs resolved via encrypted DNS either circumvent or are not properly handled by the following Secure Client features: Umbrella DNS protection, Umbrella web protection (when name-based redirect rules are used), AnyConnect VPN (split DNS, dynamic split tunneling and Always On with name-based exceptions), Network Visibility (reporting of peer FQDN) and Zero Trust Access (when name-based rules are applied). To mitigate this impact, you should disable encrypted DNS in browser settings pertaining to Secure Client users.

As an additional mitigation, Cisco Secure Client prohibits DNS over HTTPS (DoH) name resolution for the Windows DNS client via local policy setting Configure DNS over HTTP (DoH) name resolution (under Computer Configuration > Administrative Templates > Network > DNS Client). This change is applicable to Windows 11 and later versions and is enforced while any of the following modules is active: VPN, Umbrella Roaming Security, Network Visibility, or Zero Trust Access. Cisco Secure Client does not alter this policy setting if a conflicting setting of higher precedence (for example, domain GPO setting) is detected.

The following issues are known with Windows ARM64:

• CSCwh12493—ASDM throws an error unable to load secure client profile editor on ISE Posture profiles on ARM64

• CSCwd81735—When Secure Firewall ASA has Secure Firewall Posture (formerly HostScan) enabled and running the same 5.0 version as Secure Client, a failure could result. However, the Secure Client UI shows no status message or error. The client may still be functioning normally and responds to clicking Connect, but the status message gives no indication.

• CSCwd71408—ASA needs to add support for Cisco Secure Client binary file customization in order for scripting to work.

• CSCwh63153— Failure to launch downloader error if Windows ARM CP is not configured but agent is already installed

• ISE Posture service is unavailable. You can restore the service by manually restarting csc_ise_agent.

• ARM64 version of Java is not supported: only X86 or X64 versions.

• For the Network Visibility Module in ARM64 platforms, Module Name and Module Hash are not reported in flows that are generated for SVCHost processes.

• Installing Cisco Secure Client 5.1.0.136 and later from the XDR portal is not supported on ARM64.

If the Network Access Manager is configured for machine or user authentication while a Windows Remote Desktop Protocol attempt is made from a remote device, the connection may fail. The cause of the failure is an interface change in how Microsoft firewall establishes quarantines for the network. Until we can coordinate a resolution with Microsoft, you can try the workaround documented in CSCvo47467.

AnyConnect VPN cannot be active at the same time as any other client VPN, either Cisco software like the Cisco Secure Client for Universal Windows Platform or third-party VPNs.

Continuity Camera in macOS 13 is currently not functioning during an active VPN connection.

Those running Cisco Secure Client on macOS 12.x may experience a loss of DNS (name resolution), requiring a reboot for restoration. The cause has been identified as a macOS bug, which has been addressed in macOS 12.3 (FB9803355).

Global DNS settings Searchlist and UseDomainNameDevolution are used by Cisco Secure Client to build the DNS suffix search list for a VPN connection. Any overrides configured via local group policy will be ignored.

When a root certificate authority (CA) is public trusted, it is already in the File Certificate Store. However, if the Firefox NSS store is left enabled at the same time, the OCSP check might be bypassed, as we only support OCSP check with File Cert Store. To prevent this bypass, disable Firefox NSS store by setting ExcludeFirefoxNSSCertStore to true in the local policy file.

When using Trusted Network Detection, the automatic VPN connection may not be initiated according to the TND policy, if the system route table does not contain a default route.

If you are using web deploy to upgrade to AnyConnect or HostScan 4.10 from a version prior to 4.9.01095, an error could result. Since AnyConnect versions prior to 4.9.01095 did not have the capacity to parse the system CA store, the result is an upgrade failure, because the correct NSS certificate store path could not be determined in the user's profile directory. If you are upgrading to AnyConnect 4.10 from a release prior to 4.9.01095, copy the root certificate (DigiCertAssuredIDRootCA.pem) to /opt/.cisco/certificates/ca prior to upgrading AnyConnect on the endpoint.

If you are using Ubuntu 20.04 (which has kernel version 5.4), you must use AnyConnect 4.8 (or later), or Network Visibility Module installation fails.

Local and/or network proxies (such as software/security applications like Fiddler, Charles Proxy, or Third-party Antimalware/Security software that includes Web HTTP/HTTPS inspection and/or decryption capabilities) are not compatible with Cisco Secure Client.

With the fix of CSCvu65566 and its device ID computation change, certain deployments of Linux (particularly those that use LVM) experience a one-time connection attempt error immediately after updating from a headend to 4.9.01xxx or later. Linux users running AnyConnect 4.8 (and later) and connecting to a headend to perform an auto update (web-deploy) may receive this error: "The secure gateway has rejected the connection attempt. A new connection attempt to the same or another secure gateway is needed, which requires re-authentication." To successfully connect, you can manually initiate another VPN connection after Cisco Secure Client upgrade. After an initial upgrade to 4.9.01xxx or later, you will no longer hit this issue.

The Network Access Manager made a revision to write wireless LAN profiles to disk rather than just using temporary profiles in memory. Microsoft requested this change to address an OS bug, but it resulted in a crash of the Wireless LAN Data Usage window and eventual intermittent wireless connectivity issues. To prevent these issues, we reverted the Network Access Manager to using the original temporary WLAN profiles in memory. The Network Access Manager removes most of the wireless LAN profiles on disk when upgrading to version 4.8MR2 or later. Some hard profiles cannot be removed by the OS WLAN service when directed, but any remaining interfere with the ability for the Network Access Manager to connect to wireless networks. Follow these steps if you experience problems connecting to a wireless network after an upgrade from 4.7MR4 to 4.8MR2:

1. Stop the Secure Client Network Access Manager service.

2. From the administrator command prompt, enter

   netsh wlan delete profile name=*(AC)

This removes leftover profiles from previous versions (Secure Client 4.7MR4 to 4.8MR2). Alternatively, you can look for profiles with AC appended to the name and delete them from the native supplicant.

macOS 11 fixed an issue seen in AnyConnect version 4.8.03036 (and later) related to the nslookup command, namely nslookup not sending DNS queries through the VPN tunnel with split-include tunneling configuration. The issue initiated in AnyConnect 4.8.03036 when that version included a fix for defect CSCvo18938. The Apple-suggested changes for that defect ended up revealing another OS issue, causing the nslookup problematic behavior.

As a workaround for macOS 10.x, you can pass the VPN DNS server as a parameter to nslookup: nslookup [name] [ip_dnsServer_vpn].

(CSCvu71024) Cisco Secure Client authentication may fail if the Secure Firewall ASA headend or SAML provider uses certificates signed by the AddTrust root (or one of the intermediaries), because they expired in May 2020. The expired certificate causes Cisco Secure Client to fail and presents as a server certificate validation error, until operating systems make the required updates to accommodate the May 2020 expiration.

Windows DNS Client optimizations present in Windows 10 (and later) may result in failure to resolve certain domain names when split DNS is enabled. The workaround is to disable such optimizations by updating the following registry keys:

Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters

Value:DisableParallelAandAAAA

Data: 1

Key: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\DNSClient

Value: DisableSmartNameResolution

Data: 1

The macOS 10.15 operating system does not support 32-bit binaries. Additionally, Apple verifies that all software installed on 10.15 has been cryptographically notarized via digital signature. From AnyConnect 4.8 and later, operation on macOS 10.15 is supported with no 32-bit code.

Make note of these limitations:

• AnyConnect versions prior to 4.7.03052 may require an active internet connection to upgrade.

• HostScan versions prior to 4.8.x will not function on macOS 10.15.

• Secure Firewall Posture and ISE Posture users on macOS 10.15 will experience permission popups during initial launch.

HostScan packages earlier than 4.8.x will not function with macOS Catalina (10.15). End users who attempt to connect from macOS Catalina to Secure Firewall ASA headends running HostScan packages earlier than 4.8.x will not be able to successfully complete VPN connections, receiving a posture assessment failed message.

AnyConnect 4.10.x clients on macOS Big Sur (11.x) must use HostScan 4.9.04045 or later.

To enable successful VPN connections for Secure Firewall Posture users, all DAP and Secure Firewall Posture policies must be HostScan 4.8.00175 (or later) compatible. Refer to AnyConnect HostScan Migration 4.3.x to 4.6.x and Later for additional information related to policy migration from HostScan 4.3.x to 4.8.x.

As a workaround to restore VPN connectivity, administrators of systems with Secure Firewall Posture packages on their Secure Firewall ASA headends may disable Secure Firewall Posture. If disabled, allSecure Firewall Posture posture functionality, and DAP policies that depend on endpoint information, will be unavailable.

The associated field notice can be found here: https://www.cisco.com/c/en/us/support/docs/field-notices/704/fn70445.html.

macOS 10.15 (and later) requires that applications obtain user permissions for access to Desktop, Documents, Downloads, and Network Volume folders. To grant this access, you may see popups during an initial launch of Secure Firewall Posture, ISE Posture (when ISE posture is enabled on the network), or DART (when ISE posture or Cisco Secure Client is installed). ISE posture and Secure Firewall Posture use OPSWAT for posture assessment on endpoints, and the posture checks access these folders based on the product and policies configured.

At these popups, you must click OK to have access to these folders and to continue with the posture flow. If you click Don't Allow, the endpoint may not remain compliant, and the posture assessment and remediation may fail without access to these folders.

To Remedy a Don't Allow Selection

The permission popups will reappear with a subsequent start of posture, and the user can click OK to grant access.

GUI resource customization on macOS is currently not supported.

Cisco Secure Client Umbrella module is incompatible with SentinelOne endpoint security software.

You cannot use PMK-based roaming with Network Access Manager on Windows.

Due to system security restrictions, DART now requires administrator privileges on macOS, Ubuntu, and Red Hat to collect logs.

AnyConnect releases 4.6.2 and 4.6.3 had IPsec connection issues. With the restoration of the IPsec connection (CSCvm87884) in AnyConnect release 4.7 (and later), Diffie-Hellman groups 2 and 5 in FIPS mode are no longer supported. Therefore, Cisco Secure Client in FIPS mode can no longer connect to Secure Firewall ASA prior to release 9.6 and with configuration dictating DH groups 2 or 5.

(Only Impacting users using Firefox prior to 58) Due to the NSS certificate store DB format change starting with Firefox 58, Cisco Secure Client also made the change to use new certificate DB. If using Firefox version prior to 58, set NSS_DEFAULT_DB_TYPE="sql" environment variable to 58 to ensure Firefox and Cisco Secure Client are accessing the same DB files.

If your wired or wireless network settings or specific SSIDs are pushed from a Windows group policy, they can conflict with the proper operation of the Network Access Manager. With the Network Access Manager installed, a group policy for wireless settings is not supported.

Windows 10 version 1703 changed their WLAN behavior, which caused disruptions when the Network Access Manager scans for wireless network SSIDs. Because of a bug with the Windows code that Microsoft is investigating, the Network Access Manager's attempt to access hidden networks is impacted. To provide the best user experience, we have disabled Microsoft's new functionality by setting two registry keys during Network Access Manager installation and removing them during an uninstall.

AnyConnect 4.5.02XXX and later has additional functionality and warnings to guide users through the steps needed to leverage complete capabilities, by enabling the Secure Client, formerly AnyConnect, software extension in their macOS Preferences -> Security & Privacy pane. The requirement to manually enable the software extension is a new operating system requirement in macOS 10.13 (High Sierra). Additionally, if Secure Client is upgraded before a user’s system is upgraded to macOS 10.13 and later, the user will automatically have the Secure Client software extension enabled.

Users running macOS 10.13 (and later) with a version earlier than 4.5.02XXX must enable the Secure Client, formerly AnyConnect, software extension in their macOS Preferences -> Security & Privacy pane. You may need to manually reboot after enabling the extension.

As described in https://support.apple.com/en-gb/HT208019, macOS system administrators potentially have additional capabilities to disable User Approved Kernel Extension Loading, which would be effective with any currently supported version of Secure Client.

If a network change or power event occurs, a posture process that is interrupted will not complete successfully. The network or power change results in the Cisco Secure Client downloader error that must be acknowledged by the user before continuing the process.

All connections to WWAN/3G/4G/5G must be manually triggered by the user. The Network Access Manager does NOT automatically connect to these networks if no wired or wireless connection is available.

On macOS, a keychain authentication prompt may appear after the VPN connection is initiated. The prompt only occurs when access to a client certificate private key is necessary, after a client certificate request from the secure gateway. Even if the tunnel group is not configured with certificate authentication, certificate mapping may be configured on the Secure Firewall ASA, causing the keychain prompts when the access control setting for the client certificate private key is configured as Confirm Before Allowing Access.

Configure the Cisco Secure Client profile to restrict Secure Client access strictly to clients certificates from the login keychain (in the ASDM profile editor, choose Login under Preferences (Part 1) - Certificate Store - macOS). You can stop the keychain authentication prompts with one of the following actions:

• Configure the certificate matching criteria in the client profile to exclude well-known system keychain certificates.

• Configure the access control setting for the client certificate private keys in the system keychain to allow access to Cisco Secure Client.

The dashboard to retrieve the OrgInfo.json file is https://dashboard.umbrella.com. From there you navigate to Identities > Roaming Computers, click the + (Add icon) in the upper left, and click Module Profile from the Cisco Secure Client Umbrella Roaming Security Module section.

For best results, we recommend a clean install of Cisco Secure Client on a Windows 10 system and not an upgrade from Windows 7/8/8.1. If you are planning to perform an upgrade from Windows 7/8/8.1 with Cisco Secure Client pre-installed, make sure that you first upgrade Cisco Secure Client prior to uprading the operating system. The Network Access Manager Module must be uninstalled prior to upgrading to Windows 10. After the system upgrade is complete, you can re-install Network Access Manager on the system. You may also choose to fully uninstall Cisco Secure Client and re-install one of the supported versions after upgrading to Windows 10.

Formerly, if a split-include network was a Supernet of a Local Subnet, the local subnet traffic was not tunneled unless a split-include network that exactly matches the Local Subnet was configured. With the resolution of CSCum90946, when a split-include network is a Supernet of a Local Subnet, the Local Subnet traffic is tunneled, unless a split-exclude (deny 0.0.0.0/32 or ::/128) is also configured in the access-list (ACE/ACL).

The following configuration is required when a Supernet is configured in the split-include and the desired behavior is to allow LocalLan access:

• access-list (ACE/ACL) must include both a permit action for the Supernet and a deny action for 0.0.0.0/32 or ::/128.

• Enable Local LAN Access in the Cisco Secure Client profile (in the Preferences Part 1 menu) of the profile editor. (You also have the option to make it user controllable.)

(For Windows 7, 8, and 8.1 users running an AnyConnect version prior to 4.9.03047) When the client uses a SHA512 certificate for authentication, authentication fails, even though the client logs show that the certificate is being used. The ASA logs correctly show that no certificate was sent by AnyConnect. These versions of Windows require that you enable support for SHA512 certificates in TLS 1.2, which is not supported by default. Refer to https://support.microsoft.com/en-us/kb/2973337 for information on enabling support for these SHA512 certificates. 4.9.03049

After a fresh installation, you see ISE posture log trace messages as expected. However, if you go into the ISE Posture Profile Editor and change the Enable Agent Log Trace file to 0 (disable), a service restart of Cisco Secure Client is required to get expected results.

If you are using macOS 10.9 or later and want to use ISE posture, you may need to do the following to avoid issues:

• Turn off certificate validation to avoid a "failed to contact policy server" error during posture assessment.

• Disable the captive portal application; otherwise, discovery probes are blocked, and the application remains in pre-posture ACL state.

The Firefox certificate store on macOS is stored with permissions that allow any user to alter the contents of the store, which allows unauthorized users or processes to add an illegitimate CA into the trusted root store. Cisco Secure Client no longer utilizes the Firefox store for either server validation or client certificates.

If necessary, instruct your users how to export your Cisco Secure Client certificates from their Firefox certificate stores, and how to import them into the macOS keychain. The following steps are an example of what you may want to tell your Cisco Secure Client users.

1. Navigate to Firefox > Preferences > Privacy & Security > Advanced, Certificates tab, click View Certificates.

2. Select the Certificate used for Cisco Secure Client, and click Export.

   Your Cisco Secure Client Certificate(s) will most likely be located under the Authorities category. Verify with your Certificate Administrator, as they may be located under a different category (Your Certificates or Servers).

3. Select a location to save the Certificate(s), for example, a folder on your desktop.

4. In the Format pull down menu, select X.509 Certificate (DER). Add the .der extension to the certificate name, if required.

   

   Note	If more than one Cisco Secure Client Certificate and/or a Private Key is used/required, repeat the above process for each Certificate).

5. Launch KeyChain. Navigate to File, Import Items…, and select the Certificate that you exported from Firefox.

   In the Destination Keychain:, select the desired Keychain. The login Keychain that is used for this example may not be the one used at your company. Ask your Certificate Administrator to which Keychain your certificate(s) should be imported.

6. In the Destination Keychain:, select the desired Keychain. The login Keychain that is used for this example may not be the one used at your company. Ask your Certificate Administrator to which keychain your certificate(s) should be imported.

   
   

   

   
   

7. Repeat the preceding steps for additional Certificates that are used or required for Cisco Secure Client.

Automatic upgrades of Cisco Secure Client software via WebLaunch will work with limited user accounts as long as there are no changes required for the ActiveX control.

Occasionally, the control will change due to either a security fix or the addition of new functionality.

Should the control require an upgrade when invoked from a limited user account, the administrator must deploy the control using the Cisco Secure Client pre-installer, SMS, GPO or other administrative deployment methodology.

Java 7 can cause problems with Cisco Secure Client and Secure Firewall Posture. A description of the issues and workarounds is provided in the Troubleshooting Technote Java 7 Issues with AnyConnect, CSD/HostScan, and WebVPN - Troubleshooting Guide, which is in Cisco documentation under Security > CiscoSecure Firewall Posture.

To allow local DHCP traffic to flow in the clear when Tunnel All Networks is configured, Cisco Secure Client adds a specific route to the local DHCP server when Cisco Secure Client connects. To prevent data leakage on this route, Cisco Secure Client also applies an implicit filter on the LAN adapter of the host machine, blocking all traffic for that route except DHCP traffic.

Network connectivity provided by Bluetooth or USB tethered mobile phones or mobile data devices are not specifically qualified by Cisco and should be verified with Cisco Secure Client before deployment.

Cisco Secure Client supports Smartcard provided credentials in the following environments:

• Microsoft CAPI 1.0 and CAPI 2.0 on Windows 10 (and later).

• Keychain on macOS, and CryptoTokenKit on macOS 10.12 and higher.

  Note	Cisco Secure Client does not support Smart cards on Linux or PKCS #11 devices.

Cisco performs a portion of Cisco Secure Client testing using these virtual machine environments:

• VM Fusion 7.5.x, 10.x, 11.5.x

• ESXi Hypervisor 6.0.0, 6.5.0, and 6.7.x

• VMware Workstation 15.x

We do not support running Cisco Secure Client in virtual environments; however, we expect Cisco Secure Client to function properly in the VMWare environments we test in.

If you encounter any issues with Cisco Secure Client in your virtual environment, report them. We will make our best effort to resolve them.

When Auto Update is disabled for a client running Cisco Secure Client, the Secure Firewall ASA must have the same version of Cisco Secure Client or earlier installed, or the client will fail to connect to the VPN.

To avoid this problem, configure the same version or earlier Cisco Secure Client package on the Secure Firewall ASA, or upgrade the client to the new version by enabling Auto Update.

When the Network Access Manager operates, it takes exclusive control over the network adapters and blocks attempts by other software connection managers (including the Windows native connection manager) to establish connections. Therefore, if you want Cisco Secure Client users to use other connection managers on their endpoint computers (such as iPassConnect Mobility Manager), they must disable Network Access Manager either through the Disable Client option in the Network Access Manager GUI, or by stopping the Network Access Manager service.

The Intel wireless network interface card driver, version 12.4.4.5, is incompatible with Network Access Manager. If this driver is installed on the same endpoint as the Network Access Manager, it can cause inconsistent network connectivity and an abrupt shutdown of the Windows operating system.

Applications like antivirus, antimalware, and Intrusion Prevention System (IPS) can misinterpret the behavior of Cisco Secure Client applications as malicious. You can configure exceptions to avoid such misinterpretation. After installing the Cisco Secure Client modules or packages, configure your antivirus software to allow the Secure Client Installation folder or make security exceptions for the Secure Client applications.

IKEv2 does not support the public-side proxy. If you need support for that feature, use SSL. Private-side proxies are supported by both IKEv2 and SSL as dictated by the configuration sent from the secure gateway. IKEv2 applies the proxy configuration sent from the gateway, and subsequent HTTP traffic is subject to that proxy configuration.

Cisco Secure Client sometimes receives and drops packet fragments with some routers, resulting in a failure of some web traffic to pass.

To avoid this, lower the value of the MTU. We recommend 1200. The following example shows how to do this using CLI:

hostname# config t
hostname(config)# group-policy DfltGrpPolicy attributes
hostname(config-group-policy)# webvpn
hostname(config-group-webvpn)# anyconnect mtu 1200

To set the MTU using ASDM, go to Configuration > Network (Client) Access > Group Policies > Add or Edit > Advanced > AnyConnect Client.

If Dead Peer Detection (DPD) is enabled for DTLS, the client automatically determines the path MTU. If you previously reduced the MTU using the Secure Firewall ASA, you should restore the setting to the default (1406). During tunnel establishment, the client auto-tunes the MTU using special DPD packets. If you still have a problem, use the MTU configuration on the Secure Firewall ASA to restrict the MTU as before.

Windows Active Directory Wireless Group Policies manage the wireless settings and any wireless networks that are deployed to PCs in a specific Active Directory Domain. When installing the Network Access Manager, administrators must be aware that certain wireless Group Policy Objects (GPOs) can affect the behavior of the Network Access Manager. Administrators should test the GPO policy settings with the Network Access Manager before doing full GPO deployment. GPOs pertaining to wireless networks are not supported.

To use Network Access Manager, you may need to adjust the FreeRADIUS configuration. Any ECDH related ciphers are disabled by default to prevent vulnerability. In /etc/raddb/eap.conf, change the cipher_list value.

A mobile endpoint running Windows 10 or later must do a full EAP authentication instead of leveraging the quicker PMKID reassociation when the client roams between access points on the same network. Consequently, in some cases, Cisco Secure Client prompts the user to enter credentials for every full authentication if the active profile requires it.

After one uses Cisco Secure Client to establish a VPN session with Windows 7 or later on a remote LAN, the network browsers on the other devices in the user’s LAN display the names of hosts on the protected remote network. However, the other devices cannot access these hosts.

To ensure the Cisco Secure Client host prevents the hostname leak between subnets, including the name of the Cisco Secure Client endpoint host, configure that endpoint to never become the primary or backup browser.

1. Enter regedit in the Search Programs and Files text box.

2. Navigate to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Browser\Parameters\

3. Double-click MaintainServerList.

The Edit String window opens.

1. Enter No.

2. Click OK.

3. Close the Registry Editor window.

The Cisco Secure Client certificate revocation warning popup window opens after authentication if Secure Client attempts to verify a server certificate that specifies the distribution point of an LDAP certificate revocation list (CRL), if the distribution point is only internally accessible.

If you want to avoid the display of this popup window, do one of the following:

• Obtain a certificate without any private CRL requirements.

• Disable server certificate revocation checking in Internet Explorer.

  Caution

  Disabling server certificate revocation checking in Internet Explorer can have severe security ramifications for other uses of the OS.

If you try to search for messages in the localization file, they can span more than one line, as shown in the example below:

msgid ""
"The service provider in your current location is restricting access to the "
"Secure Gateway. "

When Cisco Secure Client for macOS attempts to create an SSL connection to a gateway running IOS, or when Cisco Secure Client attempts to create an IPsec connection to a Secure Firewall ASA from behind certain types of routers (such as the Cisco Virtual Office (CVO) router), some web traffic may pass through the connection while other traffic drops. Cisco Secure Client may calculate the MTU incorrectly.

To work around this problem, manually set the MTU for the Cisco Secure Client adaptor to a lower value using the following command from the macOS command line:

sudo ifconfig utun0 mtu 1200

On Windows computers, users with limited or standard privileges may sometimes have write access to their program data folders. These privileges could allow them to delete the Cisco Secure Client profile and thereby circumvent the Always-On feature. To prevent this, configure the computer to restrict access to the C:\ProgramData folder, or at least the Cisco sub-folder.

Using Windows 10 or later, the Wireless Hosted Network feature can make Cisco Secure Client unstable. When using Cisco Secure Client, we do not recommend enabling this feature or running front-end applications that enable it (such as Connectify or Virtual Router).

Cisco Secure Client requires the Secure Firewall ASA to accept TLSv1 or TLSv1.2 traffic, but not SSLv3 traffic. The SSLv3 key derivation algorithm uses MD5 and SHA-1 in a way that can weaken the key derivation. TLSv1, the successor to SSLv3, resolves this and other security issues present in SSLv3.

Cisco Secure Client cannot establish a connection with the following Secure Firewall ASA settings for “ssl server-version”:

ssl server-version sslv3

ssl server-version sslv3-only

If you have Trend Micro on your device, the Network Access Manager will not install because of a driver conflict. You can uninstall the Trend Micro or uncheck trend micro common firewall driver to bypass the issue.

None of the supported antimalware and firewall products report the last scan time information. Secure Firewall Posture reports the following:

• For antimalware

  • Product description

  • Product version

  • File system protection status (active scan)

  • Data file time (last update and timestamp)

• For firewall

  • Product description

  • Product version

  • Is firewall enabled

You may experience long reconnects on Windows if IPv6 is enabled and auto-discovery of proxy setting is either enabled in Internet Explorer or not supported by the current network environment. As a workaround, you can disconnect any physical network adapters not used for VPN connection or disable proxy auto-discovery in IE, if proxy auto-discovery is not supported by the current network environment.

On Windows clients that support ActiveX controls, user accounts with limited privileges cannot upgrade ActiveX controls and therefore cannot upgrade Cisco Secure Client with the web deploy method. For the most secure option, Cisco recommends that users upgrade the client from within the application by connecting to the headend and upgrading.

Note	If the ActiveX control was previously installed on the client using the administrator account, the user can upgrade the ActiveX control.

Network Access Manager does not support PKC or CCKM caching. Fast roaming is unavailable on all Windows platforms.

Cisco Secure Client includes an Application Programming Interface (API) for those who want to write their own client programs.

The API package contains documentation, source files, and library files to support a C++ interface for the Cisco Secure Client. You can use the libraries and example programs for building on Windows, Linux and MAC platforms. The Makefiles (or project files) for the Windows platform are also included. For other platforms, it includes platform specific scripts showing how to compile the example code. Network administrators can link their application (GUI, CLI, or embedded application) with these files and libraries.

You can download the APIs from Cisco.com.

For support issues regarding the Cisco Secure Client API, send e-mail to the following address: anyconnect-api-support@cisco.com.