Cisco AnyConnect VPN Client Installation Guide for Single Factor Authentication: Windows

Transcription

1 1. See Appendix A for OS compatibility. See Appendix B, for supported browsers, and Appendix C for Java requirements (web install only; perform manual installation if web install fails). See Appendix D for known issuses with AnyConnect on Windows. 2. Double click the.exe file downloaded via web browser. Click Next.

2 3. Accept the License Agreement. Click Next. 4. Click Install.

3 5. Wait 6. Click Finish.

4 7. Open the Cisco AnyConnect Secure Mobility Client application. 8. Enter ramsvpn.vcu.edu in the connection bar. Click Connect. 9. Username and Password is your eid and eid password. Click OK. 10. Click Accept. ATTENTION: After the AnyConnect client is installed, there is no reason to login via web browser to establish a VPN session. Steps 7 10 above are the normal login procedure.

5 Appendix A Supported Operating Systems Cisco AnyConnect Secure Mobility Client 4.0 supports the following operating systems. Operating System Version Windows Windows 8.1 x86(32-bit) and x64(64-bit) Windows 8 x86(32-bit) and x64(64-bit) Windows 7 x86(32-bit) and x64(64-bit) Mac Mac OS X Mac OS X 10.9 Mac OS X 10.8 Linux Red Hat 6 (64-bit) Ubuntu 12.x (64-bit) Note Cisco no longer supports AnyConnect releases for Windows XP. Mobile: Android (version varies across supported devices): user/guide/b_android_anyconnect_user_guide_4-0- x.html#reference_6124ab60e6054bf4b1ac c4 Windows Mobile not supported on Cisco AnyConnect version 4.0. Version 3.0 and below may be supported. Apple ios not supported on Cisco AnyConnect version 4.0. Version 2.5 and below may be supported.

6 Appendix B ***Minimum SSL version to negotiate is TLSv1.2. Supported Web Browsers (***Only matters for automatic/web install of client**) OS / Browser Chrome Firefox Internet Explorer Safari OS X , 38, 39 32, 33, 34-7 OS X , 38, 39 32, 33, 34 - *6 OS X , 38, 39 32, 33, 34 - *6, *5 Windows , 38, 39 32, 33, Windows 8 37, 38, 39 32, 33, Windows 7 37, 38, 39 32, 33, 34 11, 10, 9 - Windows Vista 37, 38, 39 32, 33, **In some browsers, it may be necessary to manually enable TLS version 1.2 via the browser settings. *According to some sources, Safari 5, or 6 does not support TLSv1.2. Still some others indicate that it is supported. Appendix C Java Compatibility (***Only matters for automatic/web install of client**) ***Java is only necessary for web-based installation of the AnyConnect client. ***Java is not a factor in the manual intstallation of the AnyConnect client. - Java Runtime Environment 1.4 to 1.7, and Java 8, is supported. - On Mac OS X, Apple s JRE is supported.

7 Appendix D Known Issues with Cisco AnyConnect Client on Windows Failed to initialize connection subsystem Win MS patch Cisco Bug ID: CSCus89729 ( Symptom: AnyConnect users on Windows 8.1 will receive a "Failed to initialize connection subsystem" error after installing the Windows /10/15 security patch. This OS defect introduced with the 02/10/15 patch update will also impact WIndows 7 users with IE11. Windows Server 2008/2012 are also impacted by this defect, but neither is a supported OS for AnyConnect. Some end users have also reported that this patch has negatively impacted other non-cisco SW on the system. Conditions: AnyConnect 3.1.x /4.0.x Windows 8.1 & Windows 7 w/ IE11 installed (02/10/15 Security patch) Workarounds: Workaround #1: Close the Cisco AnyConnect Window and the taskbar mini-icon Right click vpnui.exe in the 'Cisco AnyConnect Secure Mobility Client' folder. (C:\Program Files (x86)\cisco\cisco AnyConnect Secure Mobility Client\) Click on the 'Run compatibility troubleshooter' button Choose 'Try recommended settings' The wizard suggests Windows 8 compatibility. Click 'Test Program'. This will open the program. Close Some customers have reported that they needed to also set up compatibility mode for the vpnagent.exe executable. Workaround #2: Customers can uninstall the KB update from Microsoft. However, this will also remove any other security fixes provided by Microsoft as part of the update. This can be removed under:

8 Control Panel / Programs / Programs and Features, click "View installed updates? on the left and locate and uninstall the updated labeled with KB This update is not visible when you try to locate it through the Windows Update application's history as it appears to have been bundled with another update, but it is singly accessible via Control Panel as noted here. Further Problem Description: We have root caused a specific OS bug introduced in Microsoft's 02/10/15 patch and have escalated this to Microsoft on 02/11/15. Microsoft is responsible for issuing a patch for this issue. Since a fix must come from Microsoft, customers are encouraged to open up their own case directly with Microsoft. To speed up the Microsoft support triage process, customers are welcome to reference Cisco's existing Microsoft case ID: The regression was introduced by Microsoft as part of: Secure Channel cumulative update changes TLS protocol renegotiation and fallback behavior which was included with Microsoft Security Bulletin MS Critical Security Update for Internet Explorer ( ). The specific function that is broken as a result of the patch is the SChannel API 'SSLEmptyCache()'.