Guest

Cisco Secure Services Client

Release Notes for Cisco Secure Services Client, Release 4.2.3

 Feedback

Table Of Contents

Release Notes for Cisco
Secure Services Client Release 4.2.3

Contents

Introduction

System Requirements

Supported OS Environments

New and Changed Information

New Features

Limitations and Restrictions

Unsupported Environmental Features

Important Notes

Roaming and Disk Protection Applications

Disabling Multiple Clients

User Certificates from the Windows Certificate Store

Restarting the SSC Service

Managing Adapters

Caveats

Open Caveats

Resolved Caveats

Closed Caveats

Troubleshooting

Related Documentation

Obtaining Documentation and Submitting a Service Request


Release Notes for Cisco
Secure Services Client Release 4.2.3


May, 2009

Contents

Introduction

System Requirements

New and Changed Information

Limitations and Restrictions

Important Notes

Caveats

Troubleshooting

Related Documentation

Obtaining Documentation and Submitting a Service Request

Introduction

This document describes important notes, limitations, open caveats, resolved caveats, and closed caveats for Cisco Secure Services Client (SSC) Release 4.2.3.

System Requirements

Supported OS Environments

XP Professional (SP1, SP2), 2K (SP4), Win2K Servers (SP4), Win2003 Server

Novell Client version 4.91 SP1 with Hotfix TID2972711

New and Changed Information

New Features

This is a maintenance release and does not contain any new features.

Limitations and Restrictions

Unsupported Environmental Features

The following environmental features are not supported in release 4.0.5 or 4.1.0:

Fingerprint scanners may not be compatible with SSC. If you encounter problems, Cisco recommends that you disable the fingerprint scanner.

For example, SSC does not function properly with IBM ThinkVantage Fingerprint device software versions earlier than version 5. It is recommended that users update to the most recent version available (5.6 at the time of this note) before evaluating compatibility with their individual machine. This update can be obtained at the following URL:

http://www-307.ibm.com/pc/support/site.wss/TVAN-EAPFPR.html

SSC does not support EAP-FAST authentication with an access point local RADIUS server.

In network environments using token-based credentials, Cisco recommends disabling the Next Token feature of the authentication server. If a re-authentication session occurs between the request for the next tokencode (the multi-digit code displayed by the token device) and the sending of the next tokencode, the authentication will most likely fail. The timing of a re-authentication request is not under the control of SSC but external stimuli such as roaming or authentication server timeouts.

Important Notes

Roaming and Disk Protection Applications

Software that is designed to protect a laptop's disk drive from physical jarring prevents any disk drive access while vibration is sensed. When using this feature, moving a laptop from one access point to another can cause roaming delays (interruptions in network connectivity). Such delays should not significantly affect applications that are designed to withstand network interruptions. Users can, at some risk, disable the disk-protection utility. Many laptop manufacturers suggest that users stabilize computers by placing them in standby mode before they are in transit which should prevent any problems. SSC has been tested with one such application, the ThinkVantage Active Protection System, to confirm this.

Disabling Multiple Clients

Do not configure multiple client applications (such as Windows Zero Config (WCZ) and Cisco Aironet Desktop Utility) in addition to SSC to control an access point with the same SSID. Allowing multiple applications to carry out write operations (as well as carry on EAPOL messaging required for making a connection) through the same network adapter might disrupt both applications, resulting in unpredictable behavior in both client applications.

If you must configure multiple applications with the same network, you must disable all but one of the client applications and use the enabled client to make connections.


Note SSC disables WZC when it manages a client adapter and re-enables WZC when an adapter is unmanaged or SSC is uninstalled.


SSC can be disabled easily from the Client main menu or from the system icon. Individual adapters can be disabled easily from the Manage Adapter dialog. Disabling other third-party clients might not be a simple operation. If a third-party client cannot be disabled, it should be uninstalled. For example, the Cisco Aironet Desktop Utility (ADU) must be uninstalled to allow SSC to control the wireless adapter.

User Certificates from the Windows Certificate Store

If you use user client certificates from the Windows certificate store, ensure that you understand the requirements for certificate storage and accessibility by machine and user profiles. For example, the use of client certificates from the Windows store is not supported when configuring a user-only network that requires pre-logon authentication. For more information, use the SSC's help or user guide.

Restarting the SSC Service

If SSC becomes suspended inadvertently, the SSC service must be restarted. If the service fails to stop or restart properly, you must restart the machine.

The service can always be restarted by restarting the machine.

If you have Windows administrative privileges, you can manually stop and start the SSC service by choosing Start > Control Panel > Administrative Tools > Services > Cisco Secure Services Client.

Managing Adapters

If you get a message that a Serious Adapter Problem has been encountered and SSC automatically releases control of the adapter, Cisco recommends that you reactivate control of the adapter through the SSC's Manage Adapters menu item. If this fails, you must stop and restart the Cisco Secure Services Client service through the Windows Services dialog or restart the PC.

Caveats

Open Caveats

These issues are open for SSC Release 4.2.3:

Problem with the Intel(R) PRO/Wireless 3945ABG network adapter:

A lockup condition has been observed that causes the current network access device to cycle between failed (red) and connecting (yellow) as observed in the Manage Networks window. Network connectivity is lost and the system tray icon is either steady-state idle (grey) or connecting (yellow).

Workaround: Disable and then re-enabled the network adapter (Using either the client or adapter controls of the SSC is not sufficient). From the Windows Network Connections window, select the Wireless Network Connection and right-click. Then click Disable in the resulting pop-up menu. Repeat and click Enable.

Resolved Caveats

These caveats are resolved for SSC Release 4.2.3:

CSCsx03328—Some machine passwords cause "Invalid UTF-8 sequence." Depending on the exact sequence of characters in the machine password string, sometimes the output string cannot be processed or used by the authentication engine, which results in an error being generated and passed back to the connection manager. The error "Invalid UTF-8 Sequence" puts the client into a failure state.

CSCsy30430—Can't access machine credential during re-auth while in RDP. The SSC cannot access the machine credential when requested to re-authenticate by the switch. This happens when a user is logged in remotely using RDP.

In addition, the following issues are also resolved in this release:

Invalid characters in identity: If the user identity contains invalid characters (rejected by the ACS), then the SSC GUI will not accept that identity from the user.

If the machine password expires when the machine is turned off and the machine is later turned on, the machine is unable to renew its password.

On Novell systems, workstations that contain multiple profiles sometimes authenticate or re-authenticate the wrong profile.

Closed Caveats

These caveats are closed for SSC Release 4.2.3:

CSCsj89857—Machine authentication only and anonymous PAC provision loops forever. With a specific EAP-FAST configuration, SSC never uses the provisioned PAC. SSC Release 4.x. is affected.

Workaround: None available in SSC. A possible work around is to change the ACS configuration to allow authenticated in-band provisioning.

CSCsl04385—User is prompted for password when using deployed static credentials. With certain deployed configurations that contain static credentials (username and password), the user is prompted for the password during authentication. The expectation is that the user is not prompted for username and/or password during authentications.

Workaround: None.

CSCsm51715—When SSC is configured to request credentials and remember forever, the new credentials should be saved immediately to a file after being changed, instead of waiting until the user logs off or Windows shuts down.

If the PC experiences a high system load during logoff, SSC may suffer from resource starvation. If the network profile stores credentials and has remember forever enabled, the credentials may not be stored properly.

Workaround: None.

Troubleshooting

For the most up-to-date, detailed troubleshooting information, refer to the Cisco TAC website at this URL:

http://www.cisco.com/en/US/support/index.html

Related Documentation

For more information about Cisco Secure Services Client, refer to the following documents:

Cisco Secure Services Client for Windows 2K/XP User Guide Release 4.2

http://www.cisco.com/en/US/products/ps7034/products_user_guide_list.html

The user guide contains detailed information on operating, and locally configuring the client. The single guide covers the three distinct versions of the client: the out-of-the-box version, the deployed Configurable End-User's version and the deployed Preset End-User's version. The content is taken directly from the client's embedded help system documentation.

Cisco Secure Services Client Administrator Guide Release 4.2

http://www.cisco.com/en/US/products/ps7034/prod_maintenance_guides_list.html

The administrator guide contains detailed information on deploying preconfigured end-user SSCs. This document describes the components of the underlying XML schema which controls the content and format of the deployment distribution package (configuration file). It also describes several Administrator utilities that are available to assist in the deployment process.

Obtaining Documentation and Submitting a Service Request

For information on obtaining documentation, submitting a service request, and gathering additional information, see the monthly What's New in Cisco Product Documentation, which also lists all new and revised Cisco technical documentation, at:

http://www.cisco.com/en/US/docs/general/whatsnew/whatsnew.html

Subscribe to the What's New in Cisco Product Documentation as a Really Simple Syndication (RSS) feed and set content to be delivered directly to your desktop using a reader application. The RSS feeds are a free service and Cisco currently supports RSS version 2.0.