 Feedback
|
Table Of Contents
Release Notes for Cisco AnyConnect Secure Mobility Client 2.4 for Symbian
Security Appliances and Software Supported
Limitations of the AnyConnect Secure Mobility Client for Symbian
Open Bugs in AnyConnect for Symbian
Setting Up Automatic Download of SiS Installer
Configuration and Deployment Overview
Recommended ASA Configurations
Preventing Symbian Devices from Establishing SSL VPN Connections
Release Notes for Cisco AnyConnect Secure Mobility Client 2.4 for Symbian
Updated: May 31, 2011Content
This document includes the following sections:
•
Security Appliances and Software Supported
•
•
•
•
•
•
Introduction
This document provides only Symbian information for the Cisco Secure Mobility client. This document supplements the Cisco AnyConnect VPN Client Administrator Guide. You can use the same Cisco adaptive security appliances (ASAs) to support or deploy later releases of AnyConnect for other devices simultaneously.
This release of AnyConnect provides remote users with secure VPN connections to the Cisco ASA 5500 Series using the Secure Socket Layer (SSL) protocol and the Datagram TLS (DTLS) protocol.
Seamless and secure remote access to enterprise networks is provided. If the AnyConnect VPN access point is used for traffic, the client provides a full or split include/exclude tunneling experience that allows any installed application to communicate as though connected directly to the enterprise network. If the user explicitly uses a different access point (besides the AnyConnect VPN access point), traffic is not encrypted, and packets are not visible to AnyConnect.
Devices Supported
This AnyConnect release supports the Nokia E6 and any other Nokia device that runs a "New Symbian OS." The device must be a touchscreen phone.
Note
Security Appliances and Software Supported
Only ASA models support the Cisco AnyConnect Secure Mobility client for Symbian. See the Adaptive Security Appliance VPN Compatibility Reference: http://www.cisco.com/en/US/docs/security/asa/compatibility/asa-vpn-compatibility.html for a complete list of compatibility requirements.
Table 1 shows the minimum Cisco ASA 5500 software images that support AnyConnect.
Table 1 Software Images that Support AnyConnect, Release 2.4
ASA Boot Image
8.0(4) or later
Adaptive Security Device Manager (ASDM)
6.1(3) or later
Note
AnyConnect Licensing
An AnyConnect Mobile license is required for VPN connections when using AnyConnect for Symbian.
This license is mutually exclusive per ASA, but you can configure a mixed network. The AnyConnect Mobile license is nominally priced to cover Cisco support. We offer the following trial options:
•
•
For brief descriptions and example product numbers (SKUs) of the AnyConnect user license options, see Cisco Secure Remote Access: VPN Licensing Overview.
For the latest details about the AnyConnect user license options, see Managing Feature Licenses in the Cisco ASA 5500 Series Configuration Guide using the CLI, 8.3.
Other Supported Features
Cisco supports the following AnyConnect features:
•
–
–
•
–
–
–
–
–
–
•
–
–
–
–
•
–
–
–
–
–
•
•
•
•
•
•
•
Note
•
•
•
•
•
•
Note
•
•
•
•
•
Limitations of the AnyConnect Secure Mobility Client for Symbian
This release of AnyConnect for Symbian supports only the features that are strictly related to remote access. It supports the following types of VPN configurations:
•
•
This release supports the Tunnel Keep-Alive feature; however, it can reduce the battery life of the device. Increasing the update interval can mitigate the issue.
Note
Open Bugs in AnyConnect for Symbian
Release 2.4 has the following known bugs for Symbian:
CSCto43931: Symbian Web Browser converts to Ask when needed mode when an AnyConnect VPN access point is selected as the connection.
Symbian's built-in Web Browser (like most other apps) allows the user to select the connection option as one of the following:
•
•
•
Workaround: With the Select a specific access point option, you can specify an access point (AnyConnect VPN). We recommend that you choose the intranet destination as the connection type. This selection allows the browser to use the intranet WiFi access points when available and automatically switches to VPN (AnyConnect VPN) when no other higher priority intranet access point is available.
Setting Up Automatic Download of SiS Installer
The Cisco AnyConnect Secure Mobility client for a Symbian device is installed with the standard Software Installation Script (SiS) standalone installer. The .sis file is contained within the .pkg file, and neither requires manipulation as long as you use a group URL for the connection profile, as described below. Follow these steps to set up the automatic download of the SiS installer for the user:
Step 1
Figure 1 Creating Group Policy
Step 2
Figure 2 Choosing Download AnyConnect Client
Step 3
Step 4
Step 5
Step 6
Step 7
Users can visit the given URL with their browser, authenticate using the provided credentials, and then download the AnyConnect installer.
Client User Interface
Choose the AnyConnect icon on the Nokia desktop to display the Home screen. Figure 3 shows the Home screen.
Figure 3 Nokia AnyConnect Home Screen
The Home screen lists the names of the VPN connection entries stored on the device and lets you add new VPN connection entries.
The icon bar at the bottom of the display provides navigation icons for the Home, Statistics, Preferences, and About screens.
Configuration and Deployment Overview
At minimum, AnyConnect requires the user to create a connection entry that requires the following:
•
•
AnyConnect Profiles
An AnyConnect client user profile is an XML file that enables you to identify a list of secure gateways (security appliances) that you want to make accessible. In addition, a profile conveys additional connection attributes and constraints on a user.
You can use the AnyConnect Profile editor to configure the client features within a profile; then configure the security appliance to upload this file when a Symbian device establishes a VPN connection.
Typically, a user has a single profile file. This profile contains all the hosts needed by a user, and additional settings as needed. The client downloads the profile from the head-end and creates VPN connections based on the host entries in the profile.
Note
If you choose the Prefs button, you can set preferences for some items. The items and values are populated based on the user controller preferences from the profile. Some of the items and values include the following:
•
•
–
–
–
•
•
Connection Persistence
AnyConnect for Symbian supports a full suite of authentication capabilities similar to AnyConnect for Windows, Mac OS X, and Linux.
To achieve the most transparent end user experience, use certificate-only authentication. When a digital certificate is issued, AnyConnect supports the Symbian on-demand VPN feature which enables a VPN connection to be established without user interaction. The user may also manually establish a connection.
Symbian On-Demand VPN
The Symbian On-Demand VPN feature lets an application initiate a VPN connection when a VPN access point is chosen to open a network connection. The user must choose the correct access point or destination and then, outside of AnyConnect, it is determined whether the VPN is used. For example, if your official email client is configured to use the intranet destination, the AnyConnect VPN access point automatically connects when no other connection is available through the intranet destination. No special configuration (such as hostname or DNS) is required, but Cisco provides an implementation so that users can get a connection either with or without being prompted for credentials, depending on the current default server.
Note
AnyConnect supports different kinds of authentication, either password based or certificate based. You are not required to have only certificate-based authentication during on-demand VPN.
Recommended ASA Configurations
For the best user experience, Cisco recommends using multiple connection profiles (tunnel groups) for mobile devices, depending on the authentication configuration. You will have to decide how best to balance user experience with security.
•
•
Troubleshooting
This section describes solutions to common problems related to AnyConnect for Symbian. If problems still persist after trying these solutions, contact your organization's IT support department.
•
Internet connectivity issues, a low cell signal level, or a congested network resource can often cause time-outs and unresolved host errors. If a LAN is within reach, try using your device Settings app to establish a connection with the LAN first. Retrying multiple times in response to time-outs often results in success.
•
After the session initiation starts, the connection times out if the session is not established within the stipulated timeframe (currently defaulted to five minutes). If a timeout occurs and this error appears, invoke a retry.
•
Check the validity and expiration of the certificate if you succeeded with it before. Check with your system administrator to make sure you are using the appropriate certificate for the connection.
•
Messages can be displayed only when the AnyConnect application is open.
•
Try restarting the application.
•
Manually delete the VPN configuration or Internet Access Point (IAP) from the intranet destination using Menu > Settings > Connectivity > Settings > Destinations > Intranet.
•
To conserve battery life, Symbian does not do real-time scanning for wireless access points. WiFi scanning might be delayed as much as 10 minutes (default). The timeout is configurable in the WiFi settings on the phone. Based on this timeout value, it might take time for AnyConnect to discover a new WiFi network and migrate to it, even if the phone is in the range of a known high-priority WiFi access point.
Preventing Symbian Devices from Establishing SSL VPN Connections
An adaptive security appliance (ASA) must be activated with an AnyConnect Mobile license to support Symbian SSL VPN connections. If an ASA is not activated with an AnyConnect Mobile license, it automatically denies these connection attempts.
By default, an ASA activated with an AnyConnect Mobile license lets any user who can authenticate log in from a Symbian device running AnyConnect. You can configure an ASA to prevent these connections; however, at this time, doing so requires both of the following:
•
•
To configure an ASA to prevent SSL VPN connections from Symbian, add a dynamic access policy, as follows:
Step 1
Step 2
Figure 4 DAP to Prevent SSL VPN Connections from Symbian Devices
Step 3
Deny Symbian).Step 4
Step 5
EVAL(endpoint.os.version, "EQ", "Symbian", "string")Step 6
Step 7
AnyConnect Support Policy
Cisco supports all AnyConnect software versions downloaded for the Nokia devices; however, fixes and enhancements are provided only in the most recently released version.
End-User License Agreement
For the end-user license agreement, go to: http://www.cisco.com/univercd/cc/td/doc/es_inpck/eu1jen__.pdf
OpenSSL Project
This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit (http://www.openssl.org/).
This product includes cryptographic software written by Eric Young (eay@cryptsoft.com).
This product includes software written by Tim Hudson (tjh@cryptsoft.com).
For Open Source License information for this product, please see the following link: http://www.cisco.com/en/US/docs/security/asa/asa83/license/opensrce.html#wp50053.
Related Documentation
For more information, refer to the following documentation:
•
•
•
http://www.cisco.com/en/US/docs/security/asa/roadmap/asaroadmap.html
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.
© 2011 Cisco Systems, Inc. All rights reserved.
