 Feedback
|
Table Of Contents
Release Notes for Cisco AnyConnect VPN Client, Release 2.4, for Apple iOS
Devices Supported by Cisco AnyConnect 2.4 for Apple iOS
Security Appliances and Software Supported
Limitations of the AnyConnect Secure Mobility Client for Apple iOS
Configuration and Deployment Overview
Apple iOS Specific Considerations
Release Notes for Cisco AnyConnect VPN Client, Release 2.4, for Apple iOS
Updated: October 28, 2010Contents
This document includes the following sections:
•
Devices Supported by Cisco AnyConnect 2.4 for Apple iOS
•
•
•
•
Overview
This document is intended as a supplement to the Cisco AnyConnect 2.4 Administrator Guide and includes only Apple iOS specific information. For additional information refer to the following topics in the 2.4 Administrator Guide:
•
–
–
–
–
–
–
–
–
–
•
–
–
–
–
•
Introduction
The Cisco AnyConnect Secure Mobility Client provides remote users with secure VPN connections to the Cisco ASA 5500 Series using the Secure Socket Layer (SSL) protocol and the Datagram TLS (DTLS) protocol.
The Cisco AnyConnect Secure Mobility Client for Apple iOS provides seamless and secure remote access to enterprise networks. The client provides a full tunneling experience that allows any installed application to communicate as though connected directly to the enterprise network. It runs on Apple iOS version 4.1 or later and supports connections to IPv4 and IPv6 resources over an IPv4 network tunnel. It is available from the iTunes App Store. All distribution and updates will be provided from the App Store, not the ASA.
The user interface of the application has been designed to integrate tightly with the look and feel of Apple iOS.
Devices Supported by Cisco AnyConnect 2.4 for Apple iOS
The Cisco AnyConnect Secure Mobility Client requires Apple iOS 4.1 or later and runs on the following Apple devices:
•
•
•
•
Note
Security Appliances and Software Supported
The Cisco AnyConnect Secure Mobility Client supports all Cisco Adaptive Security Appliance models. It does not support PIX devices. See the Adaptive Security Appliance VPN Compatibility Reference: http://www.cisco.com/en/US/docs/security/asa/compatibility/asa-vpn-compatibility.html for a complete list of compatibility requirements.
Table 1 shows the minimum Cisco ASA 5500 software images that support AnyConnect.
Table 1 Software Images that Support AnyConnect, Release 2.4
ASA Boot image
8.0(3).1 or later
Adaptive Security Device Manager (ASDM)
6.1(3).1 or later
Note
Supported Features
The following AnyConnect features are supported:
•
–
–
•
–
–
–
–
–
–
•
–
–
–
–
•
•
•
–
–
–
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Note
•
In addition, the Cisco AnyConnect Secure Mobility Client is compatible with the Apple iOS Connect on Demand feature and certificates enrolled directly on to the iPhone including those enrolled with AnyConnect SCEP. For further details refer to the AnyConnect Administrator Guide.
Note
Limitations of the AnyConnect Secure Mobility Client for Apple iOS
The initial release of Cisco AnyConnect Secure Mobility Client for Apple iOS supports only the features that are strictly related to remote access.
Three types of VPN configurations are supported:
•
•
•
For further details of the iPhone Configuration Utility see http://www.apple.com/support/iphone/enterprise/.
However, full network roaming capabilities are not supported for VPN configurations created with the iPhone Configuration Utility. If your users require this functionality you should use an AnyConnect profile.
Only a single AnyConnect XML profile is supported on the iOS device, and the contents of the generated configuration will always match the most recent profile. For example, if a user goes to vpn.example1.com and then goes to vpn.example2.com, the configuration for vpn.example1.com would be replaced with the one for vpn.example2.com unless the configurations are the same.
Tunnel Keep-Alive is supported, but this may reduce the battery life of the device if the update interval is set to the minimum value.
Other known features that are not offered because of battery life constraints:
•
•
•
•
•
•
•
•
•
•
•
Note
In addition, non-VPN features such as Network Access Manager, Web Security for ScanSafe, or Telemtry are also unsupported.
Client Installation
Install the AnyConnect client from Cisco AnyConnect on the Tunes App Store. For further details refer to the Cisco AnyConnect Secure Mobility Client for Apple iOS User Guide, Release 2.4.
Client User Interface
The Cisco AnyConnect Secure Mobility Client for Apple iOS uses its own user interface (Figure 1-1). The user interface has been designed to integrate tightly with the look and feel of Apple iOS. For detailed information, refer to the Cisco AnyConnect Secure Mobility Client for Apple iOS User Guide, Release 2.4.
The lower area of the Home tab provides a list of VPN connections for connecting to remote systems, and the option to add a new VPN connection. The slider switch enables you to switch AnyConnect on or off, and the status of the connection is displayed below.
Figure 1-1 Cisco AnyConnect Secure Mobility Client for Apple iOS User Interface
Figure 1-2 shows the Statistics tab, including current connection information.
Figure 1-2 Cisco AnyConnect Secure Mobility Client for Apple iOS User Interface, Statistics Tab
Clicking the Details button opens the Detailed Statistics screen (Figure 3).
Figure 3 Cisco AnyConnect Secure Mobility Client for Apple iOS User Interface, Statistics Tab, Detailed Statistics Screen
You can scroll up and down to display the following information:
•
–
–
–
•
–
–
–
•
–
–
•
–
–
•
–
–
•
–
–
–
•
–
•
•
Note
The About tab (Figure 1-4) shows version, copyright, and documentary information about the Cisco AnyConnect Secure Mobility Client for Apple iOS.
Figure 1-4 Cisco AnyConnect Secure Mobility Client User Interface, About Tab
Configuration and Deployment Overview
There are very few steps required to set up the Cisco AnyConnect Secure Mobility Client. The client needs only:
•
•
AnyConnect Profiles
Profiles provide basic information about connection setup, and users cannot manage or modify them. An AnyConnect client user profile is an XML file that lets you identify a list of secure gateways (security appliances) that you want to make accessible. In addition, the profile conveys additional connection attributes and constraints on a user.
You can use the AnyConnect Profile editor to configure the client features within the profile; then configure the security appliance to upload this file when Apple iOS connect to the VPN.
Typically, a user has a single profile file. This profile contains all the hosts needed by a user, and additional settings as needed. The client will download the profile from the head-end and create VPN connections based on the host entries in the profile.
Note
Connection Persistence
AnyConnect for Apple iOS supports a full suite of authentication capabilities similar to the AnyConnect for Windows, Mac OS X, and Linux.
To achieve the most transparent end user experience, you should use certificate-only authentication. When a digital certificate is issued, AnyConnect supports the Apple iOS Connect On Demand feature which enables a VPN connection to be established without user interaction. The user may also manually establish a connection.
Apple iOS Connect On Demand
When Use Certificates is configured and the appropriate certificate is selected, the Apple iOS Connect On Demand feature can be enabled. In the Connect on Demand configuration, the client can be configured to always connect when traffic is sent to certain resources or domains. For example anything at example.com is configured by placing .example.com in Always Connect. The leading period ( . ) prevents connections to hosts ending with *example.com, such as notexamle.com. Never Connect allows a company to exclude certain resources, for example if you don't want a VPN connection to establish automatically when connecting to a public facing Web server. The most common use case for Connect On Demand is a user briefly accessing normal internal resources.
Note
Network Roaming
The Network Roaming, or reconnect, feature enables AnyConnect to re-establish VPN connectivity when switching between networks, for example EDGE, 3G and Wi-Fi. This provides the user with seamless mobility and a secure connection that persists across networks. Network Roaming will consume more of the device's resources but when it is switched off, the connection will time out if it cannot be re-established within 20 seconds.
Note
The ASA administrator has full control over the tunneling policy. You can require all network traffic to the corporate network to use the VPN connection or enable a split tunnelling policy that will tunnel only certain networks. For further details refer to your ASA Administrator Guide.
Recommended Configurations
For the best user experience, Cisco recommends using multiple tunnel-groups for mobile devices, depending on the authentication configuration. You will have to decide how best to balance user experience with security.
•
•
Apple iOS Specific Considerations
The following considerations should be taken into account when deploying the Cisco AnyConnect Security Mobility Client 2.4 to Apple iOS devices.
•
•
•
•
•
•
Note
Troubleshooting
Initially you should enable logging and follow the troubleshooting steps in the Cisco AnyConnect Secure Mobility Client for Apple iOS User Guide, Release 2.4. If you are unable to resolve the issue by following those steps then try the following:
•
•
•
•
•
If Apple iOS prompts you to start a connection using the AnyConnect application when certificate authentication and the Apple iOS Connect On Demand feature are configured for the connection, configure the connection to use a Group URL. This is required when a connection must be established outside the application using certificate-only authentication.
AnyConnect Support Policy
Cisco supports all AnyConnect software versions downloaded from the iTunes App Store; however, fixes and enhancements are provided only in the most recently released version. Cisco is not able to provide earlier versions of AnyConnect for Apple iOS as only the most recently released version is available from the iTunes App Store.
Notices and Licensing
See the following sections for Cisco AnyConnect Secure Mobility Client license information.
The following options support full AnyConnect client functionality while specifying the number of SSL VPN sessions supported:
•
•
These licenses are mutually exclusive per device (that is, per security appliance), but you can configure a mixed network. A nominally priced AnyConnect Mobile license is also required.
License Options
For brief descriptions and example product numbers (SKUs) of the AnyConnect user license options, see Cisco Secure Remote Access: VPN Licensing Overview.
For the latest detailed information about the AnyConnect user license options, see Managing Feature Licenses in the Cisco ASA 5500 Series Configuration Guide using the CLI, 8.3.
End-User License Agreement
For the end-user license agreement, go to: http://www.cisco.com/univercd/cc/td/doc/es_inpck/eu1jen__.pdf
OpenSSL Project
This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit (http://www.openssl.org/).
This product includes cryptographic software written by Eric Young (eay@cryptsoft.com).
This product includes software written by Tim Hudson (tjh@cryptsoft.com).
For Open Source License information for this product, please see the following link: http://www.cisco.com/en/US/docs/security/asa/asa83/license/opensrce.html#wp50053.
Related Documentation
For more information, refer to the following documentation:
•
•
•
http://www.cisco.com/en/US/docs/security/asa/roadmap/asaroadmap.html
•
Additional information on using VPN connections with iOS devices is available from Apple:
•
•
•
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.
© 2010 Cisco Systems, Inc. All rights reserved.
