 Feedback
|
Table Of Contents
Release Notes for Cisco AnyConnect Secure Mobility Client 2.4.x for Android Mobile Devices
Adaptive Security Appliances (ASA)
AnyConnect for Android Feature Matrix
Known Issues and Bugs in AnyConnect 2.4.7073
Fixed Issues and Bugs in AnyConnect 2.4.7073
Known Issues and Bugs in AnyConnect 2.4.7030
Limitations of the AnyConnect Secure Mobility Client for Android
Configuration and Deployment Overview
Recommended ASA Configurations
Using the URI Handler to Automate AnyConnect Actions
Using the URI Handler to Generate a VPN Connection Entry
Using the URI Handler to Import Certificates
Using the URI Handler to Establish a VPN Connection
Using the URI Handler to Disconnect from a VPN
Disabling or Minimizing the Impact of Keepalive Messages
Release Notes for Cisco AnyConnect Secure Mobility Client 2.4.x for Android Mobile Devices
Updated: September 15, 2011Content
This document includes the following sections:
•
AnyConnect for Android Feature Matrix
•
•
•
•
•
Introduction
Written for system administrators of Cisco ASA 5500 Series adaptive security appliances, this document provides only Android-specific information for the Cisco AnyConnect Secure Mobility client, version 2.4.x. This document supplements the Cisco AnyConnect Administrator Guides. You can deploy later releases of AnyConnect for other devices simultaneously with this release.
AnyConnect 2.4.x provides remote users with secure VPN connections to the Cisco ASA 5500 Series using the Secure Socket Layer (SSL) protocol and the Datagram TLS (DTLS) protocol. It also provides seamless and secure remote access to enterprise networks. The AnyConnect client provides a full tunneling experience that allows any installed application to communicate as though connected directly to the enterprise network.
The Cisco AnyConnect for Samsung, Cisco AnyConnect for Lenovo, and Cisco AnyConnect for Rooted Android releases are available on the Android Market. The Android Market provides all AnyConnect for Android distributions and updates.
Requirements
The following sections list the secure gateway release requirements, and license and configuration options.
Note
Secure Gateway Requirements
Adaptive Security Appliances (ASA)
ASA models support the Cisco AnyConnect Secure Mobility client for Android. See the Adaptive Security Appliance VPN Compatibility Reference for a complete list of compatibility requirements.
Table 1 shows the minimum Cisco ASA 5500 software images that support AnyConnect.
Table 1 Software Images that Support AnyConnect, Release 2.4 for Android
ASA Boot image
8.0(3) or later
Adaptive Security Device Manager (ASDM)
6.1(3) or later
Cisco Routers
Any Cisco router running Cisco IOS version 15.1(1)T or later support the Cisco AnyConnect Secure Mobility client for Android.
License Options
AnyConnect for Android connections require the following licenses on the ASA:
•
–
–
•
The XX in the license code represents the last two digits of your ASA model number. The YYYY represents the number of simultaneous users.
These licenses are mutually exclusive per ASA, but you can configure a mixed network. The AnyConnect Essentials and AnyConnect Mobile licenses are nominally priced. We offer the following trial options:
•
•
For brief descriptions and example product numbers (SKUs) of the AnyConnect user license options, see Cisco Secure Remote Access: VPN Licensing Overview.
For the latest details about the AnyConnect user license options, see "Managing Feature Licenses" in the latest Cisco ASA 5500 Series Configuration Guide.
ASA Configuration Options
ASAs running Release 8.2(5+) and 8.4(2) feature AnyConnect Identification Extensions (ACIDEx) for mobile device detection. ACIDEx lets you accept or restrict mobile connections without Cisco Secure Desktop, so you can use it to grant access to mobile users without activating an AnyConnect Premium license. Earlier releases require both Cisco Secure Desktop and an AnyConnect Premium license (Table 2).
Table 2 AnyConnect Requirements for ASA Releases
Cisco Secure Desktop enabled?
Not required
Yes
Licenses required
AnyConnect Essentials or AnyConnect Premium
AnyConnect Mobile
AnyConnect Premium
AnyConnect Mobile
Dynamic access policy (DAP) endpoint configuration
Open ASDM and choose Configuration > Remote Access VPN > Network (Client) Access > Dynamic Access Policies > Add or Edit > Add to the right of the Endpoint Attributes table, change the Endpoint Attribute Type to AnyConnect, and change the Platform to Android. ASDM displays a drop-down list next to Device Type that shows the supported Samsung families; however, the drop-down options are not supported. Enter the Samsung model name into the Device Type field. Add one endpoint attribute to a DAP for each Samsung device to assign a policy to it.
Use the tabs in the Access/Authorization Policy Attributes section of the Add or Edit Dynamic Access Policy window to continue, terminate, or impose restrictions on Android connections.
Open ASDM and choose Configuration > Remote Access VPN > Network (Client) Access > Dynamic Access Policies > Add or Edit, click Advanced, and enter the following line into the Logical Expressions box to grant, restrict, or deny access to Android connections:
EVAL(endpoint.os.version, "EQ", "Android", "string")
Use the tabs in the Access/Authorization Policy Attributes section of the Add or Edit Dynamic Access Policy window to continue, terminate, or impose restrictions on Android connections.
Note: The Android user sees the message entered in the message box on the Action tab of the ASDM Add or Edit Dynamic Access Policy window only if the regular expression fails to match.
1 If you already have AnyConnect Premium and Cisco Secure Desktop, and the ASA is running 8.0(4) or later, you have the option to add the logical expression shown in the third column.
AnyConnect for Android Feature Matrix
Table 3 lists the AnyConnect features and whether Android supports them.
Known Issues and Bugs
The following sections describe the known limitations and caveats in the AnyConnect 2.4.7x releases.
Known Issues and Bugs in AnyConnect 2.4.7073
•
Figure 1 Android Installation Error
•
Fixed Issues and Bugs in AnyConnect 2.4.7073
This issue, present in AnyConnect 2.4.7030, was resolved:
If a VPN connection is established over Wi-Fi and DHCP renews the IP address of the device, its media connection to the LAN breaks, but the control connection does not. To recover, disable and re-enable WiFi.
Known Issues and Bugs in AnyConnect 2.4.7030
•
•
•
•
•
An active VPN connection may block phone services like Visual Vociemail and Multimedia Message Service (MMS) from functioning properly.Limitations of the AnyConnect Secure Mobility Client for Android
This release of AnyConnect for Android supports only the features that are strictly related to remote access. It supports connection entries that the user adds and connection entries populated by an AnyConnect profile pushed by an ASA. The Android device supports no more than one AnyConnect profile. However, a profile can consist of multiple connection entries.
AnyConnect retains only the connection entries the user added and those populated by the most recent AnyConnect profile pushed by an ASA. For example, if a user goes to vpn.example1.com and then goes to vpn.example2.com, the configuration profile imported from vpn.example2.com replaces the one imported from vpn.example1.com.
Note
The ASA does not provide distributions and updates for AnyConnect for Android. They are available only on Android Market.
This release does not support the ability to hide the AnyConnect icon displayed in the status bar while AnyConnect is disconnected.
Configuration and Deployment Overview
At minimum, AnyConnect requires the user to create a connection entry that requires the following:
•
•
Alternatively, you can use the URI handler feature to embed the connection entry into a link in an email to be sent to the user or on a website to be accessed to the user.
AnyConnect Client Profiles
An AnyConnect client user profile is an XML file that lets you identify a list of ASAs that you want to make accessible. In addition, a profile conveys additional connection attributes and constraints on a user. Users cannot modify the description and service address of an AnyConnect connection entry obtained from a profile. They cannot delete individual connection entries obtained from a profile; however, they can delete all AnyConnect data, including the profile. They can modify and delete connection entries added with a URI handler create or connect action.
You can use the AnyConnect Profile editor to configure the client features within the profile; then configure the ASA to push this file when Android establishes a VPN connection.
By default, AnyConnect sends all network traffic over the VPN connection. You can enable a split tunneling policy to control traffic flow, directing traffic appropriate for the tunnel (called split include) or traffic appropriate for the data network (called split exclude). For instructions, refer to the Cisco ASA Configuration Guide associated with the version running on the ASA.
Recommended ASA Configurations
For the best user experience, Cisco recommends using multiple AnyConnect connection profiles, also called tunnel groups, for mobile devices, depending on the authentication configuration. You will have to decide how best to balance user experience with security.
For AAA-based authentication tunnel groups for mobile devices, the tunnel group should have a very long idle-timeout, such as 24 hours, to let the client remain in a reconnecting state without requiring the user to re-authenticate.
Using the URI Handler to Automate AnyConnect Actions
The URI handler lets applications pass action requests in the form of Universal Resource Identifiers (URIs) to AnyConnect. You can use URIs to generate VPN connection entries, import a certificate chain, establish a connection to a VPN, or disconnect.
To simplify the AnyConnect user setup process, you can embed the URIs as links on webpages or email messages and give users instructions to access them.
Note
Note
As a security measure, AnyConnect prompts the user whenever an application uses the URI handler to pass an action it supports. Please inform users how to respond to the prompts if you set up URI handling. The actions and associated prompts are as follows:
•
Another application has requested that AnyConnect create a new connection tohost. Do you want to allow this? [Yes | No]•
Another application has requested that AnyConnect import a certificate bundle to the AnyConnect certificate store. Do you want to allow this? [Yes | No]•
Another application has requested that AnyConnect connect tohost. Do you want to allow this? [Yes | No]•
Another application has requested that AnyConnect disconnect the current connection. Do you want to allow this? [Yes | No]The following sections show the syntax, examples, and parameter descriptions of the supported actions.
Using the URI Handler to Generate a VPN Connection Entry
Use the AnyConnect URI handler create action to simplify the generation of an AnyConnect connection entry for users.
Insert a separate link for each connection entry you want to add to the device. We do not support multiple create actions in a single link.
Use the following syntax to insert the create action to add an AnyConnect connection entry to the endpoint configuration:
anyconnect:[//]create[/]?name=Description&host=ServerAddress[&Parameter1=Value&Parameter2= Value...]Examples:
anyconnect:create?name=SimpleExample&host=vpn.example.comanyconnect:create?name=Example with certificate&host=vpn.example.com&usecert=true&certcommonname=example-IDThe slashes before and after create are optional. The create action requires that you specify the
nameorhost. All parameters are also optional.
Note
Enter the parameter values, as follows:
•
•
vpn.example.com•
host. The valid values are:–
host. Turning usecert to true without specifying a certcommonname value sets the Certificates field to Automatic.–
•
example_user_id.Figure 2 Select Certificate Window
You might need to scroll to view the certificate required by the
host.Using the URI Handler to Import Certificates
Use the following syntax to import a certificate chain into AnyConnect, and add the import action to an email or a webpage to be displayed to the user:
anyconnect:[//]import[/]?type=pkcs12&uri=[file|http|https|ftp]:[//]=addressThe slashes before and after import are optional.
Note
Examples:
In the following example, 10.0.0.10 is the FTP server: ftp:user:password@10.0.0.10/certificate.p12:
In the following example, the URI translates to file:///sdcard/certificate.p12:
File:anyconnect:import?type=pkcs12&uri=file%3A%2F%2F%2Fsdcard%2Fcertificate.p12address is the source address of the certificate or certificate chain. It is case-sensitive.
Using the URI Handler to Establish a VPN Connection
Use either syntax expression to insert the connect action into an email or webpage to be displayed to the user:
anyconnect:[//]connect[/]?[name=Description|host=ServerAddress]anyconnect:[//]connect[/]?name=Description&host=ServerAddressExamples:
anyconnect:connect?host=hr.example.comanyconnect:connect?name=Example&host=hr.example.comThe slashes before and after connect are optional.
Note
All parameters are optional. AnyConnect applies both the create and connect actions if you specify the
nameandhost. AnyConnect attempts to establish a VPN connection to the host named at the top of the AnyConnect home window if the connect action does not specify thenameorhost.Enter the parameter values, as follows:
•
nameif you used the previous instructions to generate the connection entry on the Android device. The letters are case-sensitive.•
Using the URI Handler to Disconnect from a VPN
Use the following syntax to insert the disconnect action:
anyconnect:[//]disconnect[/]Example:
anyconnect:disconnectThe slashes are optional. The disconnect action takes no parameters.
Disabling or Minimizing the Impact of Keepalive Messages
We recommend increasing the keepalive update interval or disabling keepalive messages to conserve the battery life of mobile devices. To access the Keepalive Messages parameter, use ASDM to go to Configuration > Remote Access VPN > Network (Client) Access > Group Policies > Add or Edit > Advanced > AnyConnect Client.
We also recommend that you enable client-side dead-peer detection to let AnyConnect determine when the quality of the transmission media is too low or unavailable to continue sending traffic over the VPN connection.
Troubleshooting
Please follow the user troubleshooting instructions in the latest Cisco AnyConnect Administrator Guide. If following those instructions does not resolve the issue, try the following suggestions:
•
•
•
•
•
•
AnyConnect Support Policy
Cisco supports all AnyConnect software versions downloaded from the Android Market; however, fixes and enhancements are provided only in the most recently released version.
Licensing
For brief descriptions and example product numbers (SKUs) of the AnyConnect user license options, see Cisco Secure Remote Access: VPN Licensing Overview.
For our open source licensing acknowledgements, see Open Source Used in Cisco AnyConnect Secure Mobility Client, Release 2.4 for Android.
For the end-user license agreement, see End User License Agreement.
Related Documentation
For more information, refer to the following documentation:
•
•
•
•
•
Cisco and the Cisco Logo are trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and other countries. A listing of Cisco's trademarks can be found at www.cisco.com/go/trademarks. Third party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1005R)
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.
© 2004-2011 Cisco Systems, Inc. All rights reserved.
