Table Of Contents
Release Notes for Cisco Secure Desktop 3.6
Downloading the Latest Version of CSD
Upgrading from CSD 3.5.x to CSD 3.6.x
New Features Introduced in CSD 3.6.181
Independent Host Scan Upgrades
Which Host Scan Image Gets Enabled When There is More than One Loaded on the ASA?
Keystroke Logger Detection and Host Emulation Detection Delivered with Host Scan Package
Host Scan Keystroke Logger Detection and Host Emulation Detection User Interface
Pre-login Keystroke Logger Detection Available in Host Scan Package
Secure Desktop (Vault) Support for Windows 7
Host Scan Support for Antivirus, Antispyware, and Personal Firewall Software
System and Environment Requirements
Keystroke Logger Detection and Host Emulation Detection Delivered with CSD 3.6 Package
Keystroke Logger Detection and Host Emulation Detection Delivered with Host Scan Package
Host Scan, CSD, and AnyConnect Secure Mobility Client Interoperability
Internet Explorer 8 Settings on Windows 7
Advanced Endpoint Assessment License
Host Scan Engine Update, 3.0.7042
Downloading the Host Scan Engine Update
Before Upgrading or Downgrading Between CSD 3.5.x and 3.6.x
Backing up and Restoring the Data.xml File During Upgrade or Downgrade
Reconfigure Prelogin Operating System Checks in the Data.xml File
Endpoints and Operating Systems no Longer Supported by CSD
Endpoint Devices No Longer Supported
Operating Systems No Longer Supported
Enabling the Taskbar to Display the Yellow Lock Icon when Cache Cleaner is Running
CSD Loads Slowly or Appears to Stop
Specifying Windows 7 in a Dynamic Access Policy
Specifying Windows 7 as an Endpoint Attribute in the ASDM GUI
Specifying Windows 7 as an Operating System Attribute Using a Lua Expression
Server Certificate Length Consideration
Application Compatibility Layer and User Account Control
Responding to Java Warning Dialog Boxes
User Interface Privilege Isolation
Internet Explorer, Microsoft Office, and Adobe Acrobat Interaction with Cisco Secure Desktop
Configuring Antivirus Applications for CSD
User Guidelines Related to Cache Cleaner
History Not Erased With Multiple Explorer Windows
Cache Cleaner Installation Behavior
Cache Cleaner Interface Change
Cisco Security Agent with Secure Desktop and Cache Cleaner
CSD Installation through a Proxy
Starting Applications from within Folders Created inside Secure Desktop
Caveats Resolved by CSD Release 3.6.185
Caveats Resolved by CSD Release 3.6.181
Caveats Resolved by Host Scan Engine Update 3.0.7042
Caveats Resolved by Host Scan Engine Update 3.0.5009
Caveats Resolved by Host Scan Engine Update 3.0.4216
Caveats Resolved by Host Scan Engine Update 3.0.4207
Caveats Resolved by Host Scan Engine Update 3.0.4016
Obtaining Documentation and Submitting a Service Request
Release Notes for Cisco Secure Desktop 3.6
Last Updated: March 21, 2012This document contains release information for Cisco Secure Desktop version 3.6.x. Read the following sections carefully prior to installing, upgrading, and configuring Cisco Secure Desktop.
•
Downloading the Latest Version of CSD
•
•
•
•
•
–
–
•
This document identifies the latest enhancement and guidelines. After reading about them, use the Cisco Secure Desktop Configuration Guide for Cisco ASA 5500 Series Administrators, Version 3.6 for more information about the features; and for installation, upgrade, and configuration instructions.
Introduction
Cisco Secure Desktop (CSD) is a multifunctional component of the Cisco SSL VPN solution. The main features of CSD include:
•
•
If you want to run Secure Desktop (the "Vault") on Windows XP over an AnyConnect connection, you must configure CSD to identify Windows Vista and Windows 7 operating systems in the prelogin policy and then run Cache Cleaner for those operating systems instead of Secure Desktop.
Note
•
Cache Cleaner is only relevant to users making clientless SSL VPN connections. If your users are creating a VPN connection using the AnyConnect Secure Mobility Client, they will not need Cache Cleaner.
•
No technology that interoperates with an operating system can ensure the total removal of all data, especially from an untrusted system with potentially malicious third party software installed. However, deployments of Cisco SSL VPN and AnyConnect using CSD, when combined with other security controls and mechanisms within the context of an effective risk management strategy and policy, can help reduce risks associated with using such technologies.
Downloading the Latest Version of CSD
To download the latest version of CSD you must be a registered user of Cisco.com.
Step 1
http://www.cisco.com/en/US/products/ps6742/tsd_products_support_series_home.html
Step 2
Step 3
Step 4
Step 5
Step 6
Step 7
Step 8
Upgrading from CSD 3.5.x to CSD 3.6.x
Before upgrading from CSD 3.5.x to CSD 3.6.x, read Before Upgrading or Downgrading Between CSD 3.5.x and 3.6.x.
Changes in CSD 3.6.5005
CSD 3.6.5005 is a maintenance release that incorporates Host Scan Engine Update, 3.0.7042 and resolves the Host Scan engine defects described in Table 4. This release does not introduce any new features.
Changes in CSD 3.6.4021
CSD 3.6.4021 is a maintenance release that incorporates the Host Scan Engine Update, 3.0.5077. This release does not introduce any new features.
Changes in CSD 3.6.3002
CSD 3.6.3002 is a maintenance release that incorporates the Host Scan Engine Update, 3.0.5009. This release does not introduce any new features.
Changes in CSD 3.6.2002
CSD 3.6.1001 is a maintenance release. It incorporates the Host Scan Engine Update,3.0.5009. This release does not introduce any new features.
Changes in CSD 3.6.1001
CSD 3.6.1001 is a maintenance release. It incorporates the Host Scan Engine Update, 3.0.4216. This release does not introduce any new features.
Changes in CSD 3.6.185
CSD 3.6.185 is a maintenance release that resolves the caveats in Table 2 and incorporates the Host Scan Engine Update, 3.0.4016. This release does not introduce any new features.
New Features Introduced in CSD 3.6.181
•
•
•
•
•
•
Independent Host Scan Upgrades
Starting with CSD 3.6, the Host Scan package becomes a shared component of CSD and the AnyConnect Secure Mobility Client. Previously, the Host Scan package was one of several components available only by installing CSD.
The purpose of providing a Host Scan package separate from CSD is to allow you to update Host Scan support charts more frequently than it was possible when they were delivered solely as part of CSD. The Host Scan support charts contain the product name and version information of the antivirus, antispyware, and firewall applications you use in your prelogin policies. We deliver the Host Scan application and the Host Scan support charts, as well as other components, in the Host Scan package.
The Host Scan package can now be delivered in one of these ways: as a standalone package, with CSD, with the AnyConnect Posture Module, or with the full AnyConnect client image.
In addition to identifying operating system, antivirus, antispyware, and firewall software installed on the endpoint, the host scan package delivers the components to perform a prelogin assessment, identify keystroke loggers, and detect host emulation and virtual machines running on the endpoint. Keystroke logger detection, host emulation and virtual machine detection were also features of CSD that are now included in the Host Scan package.
Still, the Host Scan package is not a replacement for CSD. Customers that want cache cleaning or Secure Desktop (Vault) need to install and enable CSD in addition to the Host Scan package. See http://www.cisco.com/en/US/products/ps6742/products_installation_and_configuration_guides_list.html to learn about the Secure Desktop (Vault) feature in the CSD Configuration Guides.
You can install, uninstall, enable, and disable a Host Scan package using the ASA's Adaptive Security Device Manager (ASDM) or its command line interface. You can configure prelogin policies using the Secure Desktop Manager tool on the ASDM.
Which Host Scan Image Gets Enabled When There is More than One Loaded on the ASA?
The Host Scan image is delivered with the Host Scan package. It can be deployed to the endpoint from the standalone Host Scan package, the full AnyConnect Secure Mobility Client package, and Cisco Secure Desktop. Depending on what licenses you have installed on your ASA, you may have all of these packages loaded on your ASA. In that case, the ASA enables the image that you specified as the Host Scan image first and if you haven't specified one, the ASA enables the Host Scan functionality from Cisco Secure Desktop.
If you uninstall the Host Scan package, the ASA cannot enable its Host Scan image.
These scenarios describe which Host Scan package the ASA distributes when it has more than one loaded.
•
•
•
•
Keystroke Logger Detection and Host Emulation Detection Delivered with Host Scan Package
In order to help customers transition to the AnyConnect Secure Mobility Client, keystroke logger detection (KSL) and host emulation detection are now delivered with the standalone Host Scan package.
KSL and host emulation detection functions delivered with the standalone Host Scan package are identical to those delivered with CSD 3.5 but they also provide support for additional operating systems. Host Scan host emulation detection provides support for all windows desktop operating systems including x64 (64-bit) VMWare, VirtualBox, and Virtual PC. Support for these additional operating systems is not available in the host emulation detection functionality delivered with CSD 3.6 Secure Desktop (Vault) feature.
Both Host Scan and Vault are included in CSD 3.6. If CSD 3.6 is installed on the ASA, and Vault is enabled, the KSL and host emulation detection functionality provided by Vault takes precedence over the KSL and host emulation detection functionality provided in the standalone Host Scan package.
Host Scan Keystroke Logger Detection and Host Emulation Detection User Interface
The user interface provided by Host Scan keystroke logger (KSL) and host emulation functions is simpler than that provided by the Cisco Secure Desktop KSL and host emulation detection functions.
There are no longer user notifications indicating the starting of keystroke logger detection. Host Scan KSL only notifies users that a keystroke logger has been found when the keystroke logger is not listed among the List of Safe Modules specified in the Keystroke Logger & Safety Checks panel in ASDM.
There is only one translation template (pot file) for both CSD and Host Scan and there is only one translated file (po files), per language, for both CSD and Host Scan.
Pre-login Keystroke Logger Detection Available in Host Scan Package
The keystroke logger detection feature is now available with the Host Scan package. Like it does when deployed with Secure Desktop (Vault), KSL can detect the presence of keystroke loggers before the user logs in. You do not need to enable Secure Desktop (Vault) in order to enable the keystroke logger detection delivered with the Host Scan package.
Secure Desktop (Vault) Support for Windows 7
The Vault included in CSD 3.6 now provides support for x86 (32-bit) Windows 7. Other than support for this additional operating system, there are no new Vault features in CSD 3.6.
Note
We do not support running AnyConnect from within the Secure Desktop on Windows Vista or Windows 7
Host Scan Support for Antivirus, Antispyware, and Personal Firewall Software
With an Advanced Endpoint Assessment license, on Windows desktops, Cisco Secure Desktop 3.6 updates the list of antivirus, antispyware, and personal firewall applications it supports. The Cisco Secure Desktop Compatibility site lists the antivirus, antispyware, and firewall applications that Host Scan checks for on the endpoint.
System and Environment Requirements
The following sections identify the ASA platform and end-user interoperability that CSD requires or supports.
ASA Requirements
In order to take advantage of all the Host Scan engine updates in CSD 3.6, you need to install CSD 3.6 with these versions of ASA and ASDM:
•
•
•
For all other features, CSD 3.6 works with these minimum versions of ASA and ASDM:
•
•
Operating System Requirements
The following section lists the CSD endpoint functions and identifies the endpoint OSs they support.
Note
Host Scan
Host Scan supports the following operating systems:
Windows
•
•
•
•
•
Mac OS X
•
•
•
Linux
•
•
•
•
•
Note
Cache Cleaner
Cache Cleaner supports the following operating systems for 32-bit browsers only:
Windows
•
•
•
•
Mac OS X
•
•
•
Linux
•
•
•
•
•
Note
Note
Secure Desktop (Vault)
Secure Desktop (Vault) is delivered only with CSD 3.6; the Vault runs on the following operating systems:
•
•
KB935855 must be installed on systems running Windows Vista without SP1 or SP2.
•
Keystroke Logger Detection and Host Emulation Detection Delivered with CSD 3.6 Package
The KSL and host emulation detection functions included with CSD 3.6 support the following operating systems:
•
•
KB935855 must be installed on systems running Windows Vista without SP1 or SP2.
•
Keystroke Logger Detection and Host Emulation Detection Delivered with Host Scan Package
The KSL and host emulation detection functions included with the standalone Host Scan package support the following operating systems:
•
•
•
Host Scan, CSD, and AnyConnect Secure Mobility Client Interoperability
Caution
•
•
•
Tip
Browser Interoperability
These are the minimum versions of browsers Host Scan, Cache Cleaner, Secure Desktop (Vault), and Web Launch support:
•
•
•
Host Scan, Cache Cleaner, Secure Desktop (Vault), and Web Launch also require Sun Java 1.5 or later. These browsers must also have JavaScript capabilities enabled and the browsers must support XML parsing operations.
Host Scan and Cache Cleaner do not support 64-bit versions of Internet Explorer. Please instruct users of x64 (64-bit) Windows OSs to use the 32-bit version of Internet Explorer or Firefox to avoid VPN connection issues. (At this time, Firefox is available only in a 32-bit version.) If you use a 64-bit version of Internet Explorer to try to establish a VPN session with a security appliance configured to install Host Scan or Cache Cleaner on the endpoint, a "Platform Detection" message states, "Web-based launch of Cisco Secure Desktop is not supported with 64-bit versions of IE. Please retry with the 32-bit version of IE."
Internet Explorer 8 Settings on Windows 7
CSD has been tested on, and supports, Windows 7 using Internet Explorer 8 running in Browser Mode Internet Explorer 8 and Document Mode Internet Explorer 8 Standards (Page Default). CSD does not support IE8 running in IE7 modes.
License Types
Cisco Secure Desktop requires an AnyConnect Premium SSL VPN Edition (single device) or AnyConnect Premium SSL VPN Edition shared license (main device and participant device) license. Some features require the purchase of an Advanced Endpoint Assessment license.
Advanced Endpoint Assessment License
With the purchase of an Advanced Endpoint Assessment license installed on the ASA, you can use these advanced features of CSD:
•
•
Host Scan Engine Update, 3.0.7042
The Host Scan engine, which is among the components delivered AnyConnect Secure Mobility Client, identifies endpoint posture attributes of the host. An updated Host Scan package, hostscan_3.0.7042-k9.pkg, is now available. This package provides an updated Host Scan engine. See the "Independent Host Scan Upgrades" section for a detailed description of the independent Host Scan package.
The List of Antivirus, Antispyware, and Firewall Applications Supported by Host Scan 3.0.7042 is available on cisco.com. The support chart opens most easily using a Firefox browser. If you are using Internet Explorer, download the file to your computer and change the file extension from .zip to .xlsm. You can open the file in Microsoft Excel, Microsoft Excel viewer, or Open Office.
System Requirements
This new independent Host Scan package supports AnyConnect 3.x releases and CSD releases 3.5 or higher. It can be installed on ASA version 8.4 or higher.
Downloading the Host Scan Engine Update
To download the latest Cisco Host Scan Engine Updates, you must be a registered user of Cisco.com.
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Step 7
Step 8
Before Upgrading or Downgrading Between CSD 3.5.x and 3.6.x
Caution
•
•
Backing up and Restoring the Data.xml File During Upgrade or Downgrade
When upgrading from CSD version 3.5.x or earlier to CSD 3.6.x, or downgrading from CSD 3.6.x to CSD version 3.5.x or earlier, the Adaptive Security Device Manager (ASDM) overwrites the data.xml file with the default CSD settings without notifying the administrator. The data.xml file is the CSD configuration file and must be preserved or all previous configurations will be lost upon upgrade. We maintain a record of this problem in our Bug Toolkit and use the number CSCto11223 to identify it.
This problem affects the following configurations:
•
•
•
•
•
•
•
•
Tip
To backup your data.xml file before you upgrade or downgrade and reinstate it afterwards, follow this procedure:
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Step 7
Step 8
Step 9
Step 10
Step 11
Step 12
Step 13
Step 14
a.
b.
c.
d.
e.
Reconfigure Prelogin Operating System Checks in the Data.xml File
Upgrading from CSD version 3.5.x or earlier to CSD 3.6.x, or downgrading from CSD 3.6.x to CSD 3.5.x or earlier introduces a labeling mismatch in the data.xml file that results in your prelogin policies being hidden from view in the Prelogin Policy window. We maintain a record of this problem in our Bug Toolkit and use the number CSCtq02168 to identify it.
Tip
Follow this procedure to perform this workaround:
Step 1
Step 2
Step 3
Step 4
Step 5
<choose type="os_check">
<when label="Win 2K/XP" test="os_check" arg1="win2k">Step 6
"Win 2K/XP"to this string"Win 2K/XP/Vista/Win7"and save your local copy.Step 7
<choose type="os_check">
<when label="Win 2K/XP/Vista/Win7" test="os_check" arg1="win2k">Step 8
"Win 2K/XP/Vista/Win7" to this string "Win 2K/XP"and save your local copy.Step 9
Step 10
Step 11
Step 12
Step 13
Step 14
Step 15
Step 16
Administrator Guidelines
Refer to the following sections for information you should know before installing, upgrading, and configuring CSD. These sections supplement the information provided in the Cisco Secure Desktop Configuration Guide for Cisco ASA 5500 Series Administrators, Release 3.6.
Endpoints and Operating Systems no Longer Supported by CSD
This section lists hardware and software which were previously supported by CSD but are no longer. We do not maintain a list of hardware and software that CSD has never supported.
See System and Environment Requirements for a list of hardware and software CSD 3.6 does support.
Endpoint Devices No Longer Supported
Starting with release 3.6.181, CSD stopped supporting MAC PowerPCs.
Operating Systems No Longer Supported
Starting with release 3.5.841, CSD stopped supporting Windows 2000 and Mac OS X v10.4.
Browsers No Longer Supported
Starting with release 3.5.841, Cache Cleaner stopped supporting Internet Explorer 5.0.
Enabling the Taskbar to Display the Yellow Lock Icon when Cache Cleaner is Running
By default, the taskbar no longer displays the yellow lock icon while Cache Cleaner is running. Releases of Cisco Secure Desktop earlier than 3.5 displayed this icon with Cache Cleaner. To display the icon, enable keystroke logger detection, host emulation detection, or both.
Caution
CSD Loads Slowly or Appears to Stop
If CSD is taking too long to load, it may be that the SSL client (your browser) cannot access the certificate revocation list (CRL) server. In this case, your browser will attempt to reconnect. Eventually, the connection will time-out. These extra attempts delay CSD from launching.
Ensure that your CRL server is properly configured so that your browser can reach it and access the certificate revocation list. This will help CSD launch more quickly.
Here is an example of when the SSL server and SSL client attempt to reach the certificate revocation list:
During the initial SSL handshake between the ASA and the client, the ASA (the SSL server) sends down a certificate, that has its name on it, to the SSL client (your browser). Your browser then attempts to validate the certificate. For example, it could check that the certificate's name corresponds to the host and domain name the browser is pointing to. After that, the client may also contact the certificate revocation list server to determine if the certificate has been revoked.
The ASA may also request a certificate from the client, in which case, the client, if it has one, submits its client certificate. The ASA will then attempt to validate the certificate similarly to the way the client did.
Specifying Windows 7 in a Dynamic Access Policy
Specifying Windows 7 as an Endpoint Attribute in the ASDM GUI
You will be able to specify Windows 7 as an endpoint attribute, using the ASDM GUI, if you are using ASDM version 6.2.(5) on an ASA running version 8.2.2 or earlier. See Figure 1 for an example.
Figure 1 Windows 7 Specified as an Endpoint Attribute Using ASDM GUI
Specifying Windows 7 as an Operating System Attribute Using a Lua Expression
If you are running a version of ASDM, which is earlier that 6.2(5), on your ASA, you can still use a DAP to check for the Windows 7 OS but you will need to do this using a Lua expression.
To learn more about Lua expressions in Dynamic Access Policies, see the section on "Configuring Dynamic Access Policies" in Cisco Security Appliance Configuration Guide Using ASDM.
This Lua expression is true if the operating system on the endpoint is Windows 7:
(EVAL(endpoint.os.version,"EQ","Windows 7","string"))See Figure 2 for an example of the previous Lua expression displayed in the ASDM interface.
Figure 2 Windows 7 Specified in a Lua Expression
Hostscan and GPS Interaction
Host Scan does not wait for the GPS device to activate in order to retrieve location information. It reports the latest GPS location if the GPS device is active and has a GPS fix.
If the GPS hardware is off, hostscan does not switch it on. It uses the cached location information at the timestamp noted. If the mobile device has erased or invalidated latitude and longitude information, it will not be reported to hostscan.
Server Certificate Length Consideration
Many SSL connections using identity certificates with RSA key pairs that exceed 1024 bits can cause a high CPU usage on the ASA and rejected VPN log-ins.
Application Compatibility Layer and User Account Control
Windows Vista uses virtualization to provide application compatibility. CSD turns off user account control (UAC) from within Secure Desktop to avoid collisions with the CSD file system virtualization. Consequently, applications running over Secure Desktop (Vault) do not always share the same resources, such as mapped drives, as non-secure desktop applications.
Downgrade Support
CSD supports upgrades and downgrades between versions 3.6.185 and 3.4.2 on the ASA. Users can establish remote sessions with one or the other, but cannot connect to ASAs running CSD versions earlier than 3.2.1.
With the use of the procedures Before Upgrading or Downgrading Between CSD 3.5.x and 3.6.x, CSD supports upgrades and downgrades between versions 3.6.181 and 3.4.2 on the ASA. Users can establish remote sessions with one or the other, but cannot connect to ASAs running CSD versions earlier than 3.2.1.
Tip
End User Guidelines
Be sure to communicate these guidelines to end users.
Responding to Java Warning Dialog Boxes
If a user who has not added the URL of the VPN as a trusted site initiates a Firefox connection to the ASA, Firefox displays the following warning message in a dialog box: "The web site's certificate cannot be verified. Do you want to continue?" Please instruct users to do the following:
Step 1
A second dialog box indicates "The application's digital signature has been verified. Do you want to run the application?"
Step 2
Following these two steps prevents the associated dialog boxes from appearing during subsequent connection attempts originating from that user profile on that computer.
ActiveX or Java Settings
CSD tries different methods to install itself on Microsoft Windows client computers until it finds a method that works. The installation is automatic and transparent to the user, however, one of the methods must be available on the remote computer and the user must have privileges to use that method. Table 1 shows the installation methods and associated user requirements.
Note
The following Internet Explorer security settings are required. Use these settings as a guideline for other browsers:
To access and launch the executable page:
•
•
To launch ActiveX:
•
•
•
User Interface Privilege Isolation
Because tasks such as Host Scan and idle mouse detection require monitoring of other processes, CSD cannot run at a low integrity level. This means that starting CSD sometimes requires privilege elevation. Users experience prompting for privilege elevation and have to consent to use CSD.
Internet Explorer (7 or later) on Vista runs at a low integrity level by default to avoid installation of software that monitors the system. This creates a conflict with CSD. Users who have limited privileges must add the URL of the ASA to the trusted zone list before proceeding.
Windows Mail
CSD does not support Windows Mail, the e-mail client that comes with Windows Vista.
Internet Explorer, Microsoft Office, and Adobe Acrobat Interaction with Cisco Secure Desktop
CSD closes all instances of Internet Explorer, Microsoft Office applications, and Adobe Acrobat running on Windows operating systems before Secure Desktop installs or before users switch to the Secure Desktop.
If Desktop Switching is enabled, you cannot switch from a Secure Desktop session to the host desktop and then open Internet Explorer, Microsoft Office applications, or Adobe Acrobat. This Windows limitation might cause some applications running on the host desktop to fail.
Configuring Antivirus Applications for CSD
Antivirus applications can misinterpret the behavior of some of the applications included in Cisco Secure Desktop as malicious. Before installing CSD, configure your antivirus software to "white-list" or make security exceptions for these applications:
•
•
•
Home Directory Requirement
The home directory on the remote computer must not contain any folder or file named .cachedlg.zip.
User Guidelines Related to Cache Cleaner
Do Not Change Cache Locations
Cache sessions may not get cleaned if a user changes cache locations during Secure Desktop and Cache Cleaner sessions.
History Not Erased With Multiple Explorer Windows
Windows Explorer does not erase browser history because other Explorer windows could share it. Before users start Cache Cleaner, they should uncheck "Launch folder windows in a separate process" in the Windows Explorer Tools > Folder Options > View > Launch folder.
Cache Cleaner Installation Behavior
Cisco Secure Desktop's Cache Cleaner has a configurable option in the Cache Cleaner panel of Secure Desktop Manager called, Show success message at the end of successful installation. (Windows only). When this option was selected in CSD 3.4 and earlier releases, a message informed users when Cache Cleaner was successfully installed. Cache Cleaner no longer displays this message.
Cache Cleaner Interface Change
In CSD 3.4 and earlier releases, when Cache Cleaner was running, a yellow lock icon displayed in the system tray as a visual reminder to the user. Cache Cleaner no longer displays this icon.
Cache Cleaner Delay
When an SSL VPN s0ession ends, Cache Cleaner may take about a minute to clean the cache and close the browser. Differences in endpoints and the size of the cache can affect the length of the delay.
Cisco Security Agent with Secure Desktop and Cache Cleaner
Because Secure Desktop and Cache Cleaner connect tightly with the OS, the Cisco Security Agent often prompts the user to confirm that the CSD components can be trusted. It is important that the user confirms that they can be trusted when prompted by a dialog.
CSA Versions before V4.5 often prompt the user on the local desktop instead of Secure Desktop; for this reason we encourage administrators to check the "Enable switching between Secure Desktop and Local Desktop" configuration option.
Installation Guidelines
CSD Installation through a Proxy
To specify CSD installation through a proxy server, regardless of the browser, go to the Internet Options control panel under Microsoft Windows, click the Connections tab, and click the LAN Settings button.
To use the ActiveX installation of CSD, go to the "Internet Options" control panel under Windows, click the Advanced tab, and enable the "Use HTTP 1.1" option.
To use the Java installation of CSD, go to the "Java" control panel under Windows, click the General tab, click the Network Settings button, and configure the proxy.
New Certificate Required
Cisco Secure Desktop 3.6 is signed with the new certificate VeriSign Class 3 Public Primary Certification Authority - G5. Upon installation, Windows XP, Windows Vista, Mac OS X, and Linux users might see a downloader error message, such as the following:
An internal certificate chaining error has occurred.This event can occur if one or all of the following are true:
•
•
•
CSD installations and upgrades might require endpoint users to install the root CA before upgrading or installing CSD. To do so, enable Update Root Certificates and verify that the Internet is reachable before the CSD installation. By default, Update Root Certificates is enabled. Users can also update the root CA manually, as instructed on the VeriSign website.
For more information, see:
•
•
Starting Applications from within Folders Created inside Secure Desktop
Microsoft Windows treats folders created within Secure Desktop differently from other folders. An application cannot always determine the default folder location for files if you start it from within these folders. For example, if you create a folder within a Secure Desktop session, open the command prompt, change the directory to that folder without specifying the full path, and run FTP, it does not download files to that folder. We recommend that you specify the full path or explicitly change the working directory (for example, using the lcd command in the case of FTP) from within the applications. This problem occurs only for applications launched from within a shell. Otherwise, the problem does not occur.
Caveats
For your convenience in locating caveats in the Cisco Bug Toolkit, the caveat titles listed in this section are drawn directly from the Bug Toolkit database. These caveat titles are not intended to be read as complete sentences because the title field length is limited. In the caveat titles, some truncation of wording or punctuation may be necessary to provide the most complete and concise description.
Note
http://www.cisco.com/support/bugtools
To become a registered cisco.com user, go to the following website:
http://tools.cisco.com/RPF/register/register.do
The following sections lists the caveats this release resolves and the open caveats.
Caveats Resolved by CSD Release 3.6.185
Table 2 lists the caveats that have been resolved by CSD Release 3.6.185.
Caveats Resolved by CSD Release 3.6.181
This table lists the caveats that have been resolved by CSD Release 3.6.181.
Caveats Resolved by Host Scan Engine Update 3.0.7042
Table 4 lists the caveats that Host Scan Engine Update, 3.0.7042 resolves.
Caveats Resolved by Host Scan Engine Update 3.0.5009
Table 5 lists the caveats that Host Scan Engine Update, 3.0.5009 resolves.
Table 5 Caveats Resolved by Host Scan Engine Update, 3.0.5009
CSCts32184
HS:clean up persistent HostScan sessions.
Caveats Resolved by Host Scan Engine Update 3.0.4216
Table 6 lists the caveats that Host Scan Engine Update, 3.0.4216 resolves.
Caveats Resolved by Host Scan Engine Update 3.0.4207
Table 7 lists the caveats that Host Scan Engine Update, 3.0.4207 resolves.
Caveats Resolved by Host Scan Engine Update 3.0.4016
Table 8 lists the caveats that Host Scan Engine Update 3.0.4016 resolves.
Open Caveats in CSD
Table 9 lists the severity 1-3 caveats that are open in this release:
Related Documentation
•
•
•
•
•
•
Obtaining Documentation and Submitting a Service Request
For information on obtaining documentation, submitting a service request, and gathering additional information, see the monthly What's New in Cisco Product Documentation, which also lists all new and revised Cisco technical documentation, at:
http://www.cisco.com/en/US/docs/general/whatsnew/whatsnew.html
Subscribe to the What's New in Cisco Product Documentation as a Really Simple Syndication (RSS) feed and set content to be delivered directly to your desktop using a reader application. The RSS feeds are a free service and Cisco currently supports RSS Version 2.0.
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)
Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and coincidental.
© 2011 Cisco Systems, Inc. All rights reserved.
