 Feedback
|
Table Of Contents
Release Notes for Cisco AnyConnect Secure Mobility Client 2.5.x for Android Mobile Devices
AnyConnect for Samsung Devices
AnyConnect for Motorola Devices
AnyConnect for Android VPN Framework Devices
Changes in AnyConnect 2.5.5131
Changes in AnyConnect 2.5.5125
New Features in AnyConnect 2.5.5116 and 2.5.5118
User Interface and Message Localization
Trusted Network Detection (TND)
Mobile-Specific Additions to the AnyConnect VPN Client Profile
Additional URI Handler Commands
External Control of AnyConnect URI Commands
AnyConnect Lifetime and Notification Enhancements
Android AnyConnect Feature Matrix
Adaptive Security Appliance Requirements
Restricting Android Mobile Connections
Open Issues in Anyconnect 2.5.5131
Issues Fixed in AnyConnect 2.5.5131
Open Issues in AnyConnect 2.5.5125
Issues Fixed in AnyConnect 2.5.5125
Issues Fixed in AnyConnect 2.5.5116 and 2.5.118
Release Notes for Cisco AnyConnect Secure Mobility Client 2.5.x for Android Mobile Devices
Updated: September 10, 2012This document includes the following sections:
•
Changes in AnyConnect 2.5.5131
•
•
•
•
Introduction
AnyConnect provides remote users with secure VPN connections to the Cisco ASA 5500 Series using the Secure Socket Layer (SSL) protocol and the Datagram TLS (DTLS) protocol. It also provides seamless and secure remote access to enterprise networks. The AnyConnect client provides a full tunneling experience that allows any installed application to communicate as though connected directly to the enterprise network.
This document, written for system administrators of AnyConnect Secure Mobility Client and the Adaptive Security Appliance (ASA) 5500, provides Android-specific information for the following 2.5.x releases of the Cisco AnyConnect Secure Mobility Client:
•
–
•
–
–
–
–
–
–
–
The Cisco AnyConnect for Android releases are available on the Android Market. The Android Market provides all AnyConnect Android distributions and updates.
Note
This document supplements the AnyConnect Administrators Guide. You can deploy later releases of AnyConnect for other devices simultaneously with this release.
Supported Android Devices
AnyConnect supports devices from the following manufacturers:
•
•
•
•
Cisco also provides:
•
•
AnyConnect for Samsung Devices
Samsung AnyConnect Release 2.5.5131 and Samsung AnyConnect Legacy Release 2.5.5125 support the Samsung product lines listed below. The devices must be running the latest software update from Samsung and the identified Android releases. See the installation instructions in the AnyConnect for Android User Guide to determine which package applies to your device.
ACE+
GT-S7500
GT-S7500L
GT-S7500WGalaxy Beam
GT-I8530
Galaxy Note
GT-N7000
GT-I9220Galaxy Mini
GT-S5570
GT-S5570B
GT-S5570BD1
GT-S5570L
GT-S5578
SCH-I559
SGH-T499
SGH-T499V
SGH-T499YGalaxy S
2.3.3 or later
GT-I9000
GT-I9000B
GT-I9000L
GT-I9000LD1
GT-I9000M
GT-I9000T
GT-I9001'
GT-I9003
GT-I9003B
GT-I9003L
GT-I9008
GT-I9008L
GT-I9018
GT-I9088
GT-I9070
GT-I9070P
SC-02B
SCH-I400
SCH-I405
SCH-I500
SCH-I809
SCH-I909
SGH-I896
SGH-I897
SGH-I927
SGH-I997R
SGH-N013
SGH-T759
SGH-T959
SGH-T959D
SGH-T959P
SGH-T959V
SGH-T959W
SHW-M100S
SHW-M110S
SHW-M130K
SHW-M130L
SHW-M190S
SHW-M220L'
SHW-M340K
SHW-M340L
SHW-M340S
SPH-D720Galaxy S II
2.3.3 or later
GT-I9100
GT-I9100G
GT-I9100M
GT-I9100T
GT-I9100P
GT-I9103
GT-I9108
GT-I9210
GT-I9210T
SC-O2C
SC-O3D
SCH-I510
SCH-I919
SCH-I919U
SCH-J001
SCH-W999
SGH-I727
SGH-I727R
SGH-I757M
SGH-I777
SGH-N033
SGH-N034
SGH-T989
SHV-E110S
SHV-E120K
SHV-E120L
SHV-E120S
SHW-M250K
SHW-M250L
SHW-M250S
SPH-D170Galaxy S III
4.0 or later
GT-I9300
SCH-I535
SGH-I747
SGH-T999
SPH-L710Galaxy Tab 7 (WiFi only)1
2.3.3. or later
GT-P1000
GT-P1000M
GT-P1000R
GT-P1010
SC-01C
SCH-I800Galaxy Tab 7.0 Plus
GT-P6200
GT-P6210Galaxy Tab 7.7
GT-P6800
SCH-I815Galaxy Tab 8.9
3.0 or later
GT-P7300
GT-P7310Galaxy Tab 10.1
3.1 or later with Samsung Touch Wiz updates
GT-P7300
GT-P7310
GT-P7500
GT-P7500D
GT-P7500M
GT-P7500R
GT-P7510
SC-01DGalaxy W
GT-I8150
SGH-T679Galaxy Xcover
GT-S5690
Galaxy Y Pro
GT-B5510B
GT-B5510LIllusion
SCH-I110
Infuse
SCH-I997
Stratosphere
SCH-I405
1 We do not support the Sprint distribution of the Samsung Galaxy Tab 7 mobile device.
Note
AnyConnect for HTC Devices
HTC AnyConnect Release 2.5.5125 supports the HTC product lines listed at http://www.htcpro.com/enterprise/VPN, if they are running Android release 2.1-3.0 (Eclair-Honeycomb). These devices must be running the minimum software required as shown in the table. Go to Settings > About phone > Software information > Software number to determine the software number running on your device.
AnyConnect ICS+ Release 2.5.5125 must be used on the following HTC devices if they are running, or have been upgraded to, Android 4.0 (Ice Cream Sandwich) or later. If the HTC device was upgraded while HTC AnyConnect was installed, uninstall the HTC AnyConnect app and restart the device before downloading the AnyConnect ICS+ app.
•
•
•
•
•
•
•
•
•
•
•
•
•
•
The HTC Raider, also know as the HTC Holiday, does not work with Cisco AnyConnect. Cisco and HTC are working to address this issue, and on allowing the HTC AnyConnect app to work on all HTC devices, regardless of the Android release they are running.
AnyConnect for Lenovo Devices
Lenovo AnyConnect Release 2.5.5125 supports the Lenovo ThinkPad tablet product, provided the device is running the latest software update from Lenovo.
AnyConnect for Motorola Devices
Motorola AnyConnect Release 2.5.5125 supports the following Motorola product lines, provided the devices are running the latest software update from Motorola:
ATRIX 2
55.13.25
XYBOARD
RAZR
6.12.173
RAZR MAXX
6.12.173
DROID 4
6.13.215
AnyConnect for Kindle Devices
Cisco AnyConnect Release 2.5.5125 is available from Amazon for the Kindle Fire HD devices, and the New Kindle Fire, these products will be shipping mid-September 2012. Anyconnect for Kindle is supported by the Android VPN Framework and is equivalent in functionality to the AnyConnect ICS+ package.
AnyConnect for Android VPN Framework Devices
AnyConnect ICS+ Release 2.5.5125 offers VPN connectivity supported by the Android VPN Framework (AVF) in Android 4.0 (Ice Cream Sandwich) or later.
AVF provides only basic VPN connectivity. The AnyConnect AVF client, dependent upon these basic VPN capabilities, is unable to provide the full set of VPN features available in the brand-specific packages.
Note
AnyConnect for Rooted Devices
Cisco provides Rooted AnyConnect Release 2.5.5125 for rooted Android mobile devices running Android 2.1 or later, for preview and testing purposes only. Cisco does not support this client, but it works on most rooted devices running 2.1+. If you encounter issues, please report them to android-mobile-feedback@cisco.com, we will make our best effort to resolve them.
Both a tun.ko module and iptables are required. AnyConnect displays an error message informing you about what is missing when you attempt to establish a VPN connection. If the tun.ko module is missing, obtain or build it for your corresponding device kernel and place it in the
/data/local/kernel_modules/directory.
Caution
Changes in AnyConnect 2.5.5131
No new features have been added to this release. See Issues Fixed in AnyConnect 2.5.5131for changes in this release.
Changes in AnyConnect 2.5.5125
No new features have been added to this release. See Issues Fixed in AnyConnect 2.5.5125 for changes in this release.
New Features in AnyConnect 2.5.5116 and 2.5.5118
•
•
•
•
•
•
User Interface and Message Localization
AnyConnect Secure Mobility Client, Release 2.5.x for Android, now supports localization, adapting the AnyConnect user interface and messages to the user's locale.
Pre-packaged Localization
The following language translations are included in the AnyConnect package:
•
•
•
•
•
•
•
•
Localization data for these languages is installed on the Android device when AnyConnect is installed. The displayed language is determined by the locale specified in Settings > Language and Keyboard > Select locale. AnyConnect uses the language specification, then the region specification, to determine the best match. For example, after installation, a French-Switzerland (fr-ch) locale setting results in a French-Canadian (fr-ca) display. AnyConnect UIs and messages are translated as soon as AnyConnect starts. The selected localization is noted as
Activein the AnyConnect Menu > Settings > Localization Management screen.Downloaded Localization
From the ASA
For languages not in the AnyConnect package, administrators can add localization data to the ASA that is downloaded to the Android device upon AnyConnect VPN connectivity. See Localizing the AnyConnect GUI for instructions on configuring localization on an ASA.
All localization data files matching the device's language specification are downloaded to the device. AnyConnect then determines the best match based on the region specification. The selected localization data is used for translation immediately, AnyConnect does not have to be restarted for it to take effect. Users have the option to restore installed localization data in the Localization Management screen.
If the ASA does not contain localization data for the device's locale, the installed localization data from the AnyConnect application package continues to be used.
URI Localization Support
An additional way to get localization data onto a user's device is for the administrator to provide the user with an AnyConnect URI for importing localization data. For example:
anyconnect://import?type=localization&host=asa.example.com&lang=ja-jpSee Using the URI Handler to Automate AnyConnect Actions in the AnyConnect Administrators Guide for a full explanation of using URIs to administer AnyConnect.
User Localization Management
Android users can manage localization data on their own device in the Menu > Settings > Localization Management screen. Users can perform these localization activities:
•
•
Trusted Network Detection (TND)
Trusted Network Detection (TND) is an AnyConnect feature that automatically disconnects or pauses the VPN connection when the Android device roams into a trusted network where a VPN is not required, and then automatically reconnects or resumes the VPN session when the user enters an untrusted network.
TND is configured in the AnyConnect Client Profile by administrators. See Configuring Trusted Network Detection in the AnyConnect Administrator Guide for details and procedures.
TND requires the AnyConnect application to be running on the Android device. Upon download of a profile specifying TND, Launch at Startup, an AnyConnect application preference, is automatically enabled to ensure this. If AnyConnect has been exited, TND cannot re-connect the VPN session on an untrusted network.
TND does not interfere with the ability of the user to manually establish a VPN connection while on a trusted network, and it does not disconnect such a connection. TND only disconnects or pauses the VPN session, complying with the configured policy, if the user connects in an untrusted network and then roams into a trusted network For example, TND disconnects or pauses the VPN session if the user makes a VPN connection at home and then moves into the corporate office.
Note
Certificate Management
Android users now have the ability to view system certificates and manage certificates in the AnyConnect certificate store in the Menu > Settings > Certificate Management activity screen.
On the System tab, which shows root certificates used for verifying server certificates, the user can browse certificates in the System store and view details of each certificate by long pressing the certificate and choosing View certificate details.
On the AnyConnect tab, which shows the client certificates used for VPN authentication, the user can perform these tasks:
•
•
•
•
Profile Management
Profile Overview
The AnyConnect VPN Client Profile is an XML file that specifies client behavior and identifies VPN connections. Each connection entry in the VPN Client Profile specifies a secure gateway that is accessible to the endpoint device as well as other connection attributes, policies and constraints. These connection entries, in addition to the VPN connections configured locally on the mobile device by the user, are listed on the AnyConnect home screen to choose from when initiating a VPN connection.
Administrators use the AnyConnect Profile Editor to edit the VPN Client Profile XML file, configuring connection entries and client features for mobile devices. Administrators choose how to distribute the client profile by configuring the security appliance to upload a client profile onto the mobile device upon VPN connectivity, by providing the user with an AnyConnect URI link to import a client profile, or by defining a procedure for the user to manually import a client profile. See the AnyConnect Administrators Guide for details and procedures on configuring and deploying Client Profiles.
Note
•
•
•
User Profile Management
Android users manage the AnyConnect Profile on their device in the Menu > Settings > Profile Management activity screen, the user can perform these tasks:
•
•
•
URI Profile Import Support
Administrators can provide Android device users with an AnyConnect URI for importing localization data. For example:
anyconnect://import?type=localization&host=asa.example.com&lang=ja-jpSee Using the URI Handler to Automate AnyConnect Actions in the AnyConnect Administrators Guide for a full explanation of using URIs to administer AnyConnect.
Mobile-Specific Additions to the AnyConnect VPN Client Profile
Starting in release 2.5.x AnyConnect administrators can now specify the CertificatePolicy and the ActivateOnImport attribute for VPN connections in the AnyConnect VPN Client Profile.
Note
CertificatePolicy
The CertificatePolicy attribute associated with a connection entry specifies how certificates are handled for this connection. Valid values are Automatic, Manual, or Disabled:
•
•
•
ActivateOnImport
The ActivateOnImport flag associated with a connection entry identifies the connection that becomes active after the Client Profile is imported, and the current connection is disconnected. The active connection entry's description is displayed under AnyConnect VPN on the AnyConnect home screen.
If more than one connection entry has this flag set, the AnyConnect client sets the first flagged connection entry as the active connection.
Additional URI Handler Commands
The AnyConnect URI handler services action requests in the form of Universal Resource Indicators (URIs). To simplify the AnyConnect user setup process, administrators can embed the URIs as links on webpages or email messages and give users instructions to access them.
Previously, URIs could be used to provision VPN connection entries, connect to or disconnect from a VPN, and import certificates. AnyConnect 2.5.x and later provides these additional URI handler features:
–
Note
–
–
Note
External Control of AnyConnect URI Commands
The new Menu > Settings > Application Preferences > External Control setting allows the user to specify how the AnyConnect application responds to AnyConnect URIs. The External Control setting can be set to Enabled, Disabled (default), or Prompt:
•
•
•
AnyConnect Lifetime and Notification Enhancements
In previous AnyConnect Android releases, all components of AnyConnect automatically launch at device startup time. Android users now have control over when AnyConnect starts on their device and AnyConnect does not launch at device startup time by default. The user can enable this by checking the Launch at Startup preference in the Menu > Settings > Application Preferences activity. If left unchecked, AnyConnect will not launch until the user starts it.
Note
Troubleshooting Improvements
The following improvements have been made to simplify troubleshooting activities on the Android devices:
•
•
•
•
Android AnyConnect Feature Matrix
Table 1 lists the features in the following AnyConnect 2.5.x for Android packages.
Android Brand-specific AnyConnect
For supported devices, Cisco provides brand-specific AnyConnect packages that offer a full-featured VPN experience across Android operating systems. These brand-specific AnyConnect packages are provided in partnership with device vendors and are the preferred AnyConnect clients for supported devices.
Android VPN Framework AnyConnect
For other Android devices unable to use the brand-specific AnyConnect packages above, Cisco provides an AnyConnect client that offers VPN connectivity supported by the Android VPN Framework (AVF) introduced in Android 4.0 (Ice Cream Sandwich). AVF provides only basic VPN connectivity. The AnyConnect AVF client, dependent upon these basic VPN capabilities, is unable to provide the full set of VPN features available in the device-specific packages. These discrepancies are shown in the table.
Android Rooted AnyConnect
Cisco also provides an AnyConnect package for rooted Android devices equivalent in functionality to the brand-specific packages. This package works on most rooted devices running Android 2.1 or later. Brand-specific AnyConnect packages do not work on rooted devices; therefore you must use the rooted version of AnyConnect on rooted devices.
Adaptive Security Appliance Requirements
ASA Release Requirements
ASA models support the Cisco AnyConnect Secure Mobility client for Android. See the Adaptive Security Appliance VPN Compatibility Reference for a complete list of compatibility requirements.
Table 2 shows the minimum Cisco ASA 5500 software images that support AnyConnect.
Table 2 Software Images that Support AnyConnect, Release 2.5 for Android
ASA Boot image
8.0(3) or later
Adaptive Security Device Manager (ASDM)
6.1(3) or later
Note
ASA License Requirements
AnyConnect for Android connections require the following licenses on the ASA:
•
–
–
•
The XX in the license code represents the last two digits of your ASA model number. The YYYY represents the number of simultaneous users.
These licenses are mutually exclusive per ASA, but you can configure a mixed network. The AnyConnect Essentials and AnyConnect Mobile licenses are nominally priced. We offer the following trial options:
•
•
For brief descriptions and example product numbers (SKUs) of the AnyConnect user license options, see Cisco Secure Remote Access: VPN Licensing Overview.
For the latest details about the AnyConnect user license options, see "Managing Feature Licenses" in the latest Cisco ASA 5500 Series Configuration Guide.
Restricting Android Mobile Connections
ASAs running release 8.2(5+) and 8.4(2) feature AnyConnect Mobile Posture for mobile device detection. Mobile Posture lets you accept or restrict mobile connections without Cisco Secure Desktop, earlier releases require Cisco Secure Desktop.
Mobile Posture requires an AnyConnect Premium and an AnyConnect Mobile license.
Table 3 AnyConnect Requirements for ASA Releases
Cisco Secure Desktop enabled?
Not required
Yes
Dynamic access policy (DAP) endpoint configuration
Open ASDM and choose Configuration > Remote Access VPN > Network (Client) Access > Dynamic Access Policies > Add or Edit > Add to the right of the Endpoint Attributes table, change the Endpoint Attribute Type to AnyConnect, and change the Platform to Android. ASDM displays a drop-down list next to Device Type, however, the drop-down options are not supported. Enter the model name into the Device Type field. Add one endpoint attribute to a DAP for each device to assign a policy to it.
Use the tabs in the Access/Authorization Policy Attributes section of the Add or Edit Dynamic Access Policy window to continue, terminate, or impose restrictions on Android connections.
Open ASDM and choose Configuration > Remote Access VPN > Network (Client) Access > Dynamic Access Policies > Add or Edit, click Advanced, and enter the following line into the Logical Expressions box to grant, restrict, or deny access to Android connections:
EVAL(endpoint.os.version, "EQ", "Android", "string")
Use the tabs in the Access/Authorization Policy Attributes section of the Add or Edit Dynamic Access Policy window to continue, terminate, or impose restrictions on Android connections.
Note: The Android user sees the message entered in the message box on the Action tab of the ASDM Add or Edit Dynamic Access Policy window only if the regular expression fails to match.
1 If you already have AnyConnect Premium and Cisco Secure Desktop, and the ASA is running 8.0(4) or later, you have the option to add the logical expression shown in the third column.
Known Issues and Limitations
The following sections describe the known issues and limitations in the AnyConnect 2.5.x releases.
Open Issues in Anyconnect 2.5.5131
Issues Fixed in AnyConnect 2.5.5131
Open Issues in AnyConnect 2.5.5125
Issues Fixed in AnyConnect 2.5.5125
Issues Fixed in AnyConnect 2.5.5116 and 2.5.118
The OpenSSL upgrade in AnyConnect 2.5.x fixed the following OpenSSL vulnerabilities: CSCtw73326, CSCtw73351,CSCtw73360, CSCtw73368, CSCtw73379, CSCtw73387, CSCtw73394, CSCtw73399, CSCtw73407, CSCtw73414, CSCtw73419, CSCtw73423, CSCtw73430, CSCtw73434, CSCtw73439, and CSCtw73444. These vulnerabilities are not confirmed to be exploitable for Cisco AnyConnect, however Cisco is improving AnyConnect product security by upgrading to a Cisco-maintained version of OpenSSL that contains the appropriate fixes.
Guidelines and Limitations
•
•
•
•
•
Figure 1 Android Installation Error
•
•
•
•
Known Compatibility Issues
•
•
Troubleshooting
Follow the user troubleshooting instructions in the latest Cisco AnyConnect Administrator Guide. If following those instructions does not resolve the issue, try the following suggestions:
•
•
•
•
•
•
Support Policy
Cisco supports all AnyConnect software versions downloaded from the Android Market; however, fixes and enhancements are provided only in the most recently released version.
Licensing
For brief descriptions and example product numbers (SKUs) of the AnyConnect user license options, see Cisco Secure Remote Access: VPN Licensing Overview.
For our open source licensing acknowledgements, see Open Source Used in Cisco AnyConnect Secure Mobility Client, Release 2.5 for Android.
For the end-user license agreement, see End User License Agreement.
Related Documentation
For more information, refer to the following documentation:
•
•
•
•
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.
© 2004-2012 Cisco Systems, Inc. All rights reserved.
