AnyConnect software and profile updates occur when they are available and allowed by the client upon connecting to a headend. Configuring the headend for AnyConnect updates makes them available. The Update Policy settings in the VPN Local Policy file determine if they are allowed.

Update policy is sometimes referred to as software locks. When multiple headends are configured, the update policy is also referred to as the multiple domain policy.

By default, the Update Policy settings allow software and profile updates from any headend. Set the Update Policy parameters to restrict this as follows:

• Allow, or authorize, specific headends to update all AnyConnect software and profiles by specifying them in the Server Name list.

  The headend server name can be an FQDN or an IP Address. They can also be wild cards, for example: *.example.com.

  See Authorized Server Update Policy Behavior below for a full description of how the update occurs.

• For all other unspecified, or unauthorized headends:

  • Allow or disallow software updates of the VPN core module and other optional modules using the Allow Software Updates From Any Server option.

  • Allow or disallow VPN Profile updates using the Allow VPN Profile Updates From Any Server option.

  • Allow or disallow other service module profile updates using the Allow Service Profile Updates From Any Server option.

  • Allow or disallow ISE Posture Profile updates using the Allow ISE Posture Profile Updates From Any Server option.
  • Allow or disallow Compliance Module updates using the Allow Compliance Module Updates From Any Server option.

    See Unauthorized Server Update Policy Behavior below for a full description of how the update occurs.

When connecting to an authorized headend identified in the Server Name list, the other Update Policy parameters do not apply and the following occurs:

• The version of the AnyConnect package on the headend is compared to the version on the client to determine if the software should be updated.

  • If the version of the AnyConnect package is older than the version on the client, no software updates occur.

  • If the version of the AnyConnect package is the same as the version on the client, only software modules that are configured for download on the headend and not present on the client are downloaded and installed.

  • If the version of the AnyConnect package is newer than the version on the client, software modules configured for download on the headend, as well as software modules already installed on the client, are downloaded and installed.

• The VPN profile, ISE Posture profile, and each service profile on the headend is compared to that profile on the client to determine if it should be updated:

  • If the profile on the headend is the same as the profile on the client, it is not updated.

  • If the profile on the headend is different than the profile on the client, it is downloaded.

When connecting to an unauthorized headend, the Allow ... Updates From Any Server options are used to determine how AnyConnect is updated as follows:

• Allow Software Updates From Any Server:

  • If this option is checked, software updates are allowed for this unauthorized ASA. Updates are based on version comparisons as described above for authorized headends.

  • If this option is not checked, software updates do not occur. In addition, VPN connection attempts will terminate if updates, based on version comparisons, should have occurred.

• Allow VPN Profile Updates From Any Server:

  • If this option is checked, the VPN profile is updated if the VPN profile on the headend is different than the one on the client.

  • If this option is not checked, the VPN profile is not updated. In addition, VPN connection attempts will terminate if theVPN profile update, based on differentiation, should have occurred.

• Allow Service Profile Updates From Any Server:

  • If this option is checked, each service profile is updated if the profile on the headend is different than the one on the client.

  • If this option is not checked, the service profiles are not updated.

• Allow ISE Posture Profile Updates From Any Server:

  • If this option is checked, the ISE Posture profile is updated when the ISE Posture profile on the headend is different than the one on the client.

  • If this option is not checked, the ISE Posture profile is not updated. ISE Posture profile is required for the ISE Posture agent to work.

• Allow Compliance Module Updates From Any Server:

  • If this option is checked, the Compliance Module is updated when the Compliance Module on the headend is different than the one on the client.

  • If this option is not checked, the Compliance Module is not updated. The Compliance Module is required for the ISE Posture agent to work.

• Enable remote users to connect to a headend using its IP address by listing that server’s IP address in the authorized Server Name list. If the user attempts to connect using the IP address but the headend is listed as an FQDN, the attempt is treated as connecting to an unauthorized domain.

• Software updates include downloading customizations, localizations, scripts and transforms. When software updates are disallowed, these items will not be downloaded. Do not rely on scripts for policy enforcement if some clients will not be allowing script updates.

• Downloading a VPN profile with Always-On enabled deletes all other VPN profiles on the client. Consider this when deciding whether to allow or disallow VPN profiles updates from unauthorized, or non-corporate, headends.

• If no VPN profile is downloaded to the client due to your installation and update policy, the following features are unavailable:

  Service Disable	Untrusted Network Policy
  Certificate Store Override	Trusted DNS Domains
  Show Pre-connect Message	Trusted DNS Servers
  Local LAN Access	Always-On
  Start Before Logon	Captive Portal Remediation
  Local proxy connections	Scripting
  PPP Exclusion	Retain VPN on Logoff
  Automatic VPN Policy	Device Lock Required
  Trusted Network Policy	Automatic Server Selection

• In Windows, the downloader creates a separate text log (UpdateHistory.log) that records the download history. This log includes the time of the updates, the ASA that updated the client, the modules updated, and what version was installed before and after the upgrade. This log file is stored here:

  %ALLUSERESPROFILE%\Cisco\Cisco AnyConnect Secure Mobility Client\Logs directory.

• You must restart the AnyConnect service to pick up any changes in the Local Policy file.

This example shows the client update behavior when the AnyConnect version on the client differs from various ASA headends.

Given the following Update Policy in the VPN Local Policy XML file:

<?xml version="1.0" encoding="UTF-8"?>
<AnyConnectLocalPolicy acversion="2.4.140"
xmlns=http://schemas.xmlsoap.org/encoding/
xmlns:xsi=http://www.w3.org/2001/XMLSchema-instance
xsi:schemaLocation="http://schemas.xmlsoap.org/encoding/ AnyConnectLocalPolicy.xsd">
<FipsMode>false</FipsMode>
<BypassDownloader>false</BypassDownloader><RestrictWebLaunch>false</RestrictWebLaunch>
<StrictCertificateTrust>false</StrictCertificateTrust>
<RestrictPreferenceCaching>false</RestrictPreferenceCaching>
<RestrictTunnelProtocols>false</RestrictTunnelProtocols>
<UpdatePolicy>
<AllowSoftwareUpdatesFromAnyServer>false</AllowSoftwareUpdatesFromAnyServer>
<AllowVPNProfileUpdatesFromAnyServer>false</AllowVPNProfileUpdatesFromAnyServer>
<AllowServiceProfileUpdatesFromAnyServer>false</AllowServiceProfileUpdatesFromAnyServer>
<AllowISEProfileUpdatesFromAnyServer>true</AllowISEProfileUpdatesFromAnyServer>
<AllowComplianceModuleUpdatesFromAnyServer>true</AllowComplianceModuleUpdatesFromAnyServer>
<AllowManagementVPNProfileUpdatesFromAnyServer>true</AllowManagementVPNProfileUpdatesFromAnyServer>
<AuthorizedServerList>
   <ServerName>seattle.example.com</ServerName>
   <ServerName>newyork.example.com</ServerName>
</AuthorizedServerList>
</UpdatePolicy>
</AnyConnectLocalPolicy>

With the following ASA headend configuration:

The following update sequence is possible when the client is currently running AnyConnect VPN and Network Access Manager modules:

• The client connects to seattle.example.com, an authorized server configured with the same version of AnyConnect. If the VPN and Network Access Manager profiles are available for download and different than the ones on the client, they will also be downloaded.

• The client then connects to newyork.example.com, an authorized ASA configured with a newer version of AnyConnect. The VPN and Network Access Manager modules are upgraded. Profiles that are available for download and different than the ones on the client are also downloaded.

• The client then connects to raleigh.example.com, an unauthorized ASA. Even though a software update is necessary and a software update is available, the update is not allowed due to the policy determining version upgrades are not allowed. The connection terminates.