This update of AnyConnect is a maintenance release for devices running earlier versions. See Resolved Issues in AnyConnect 4.0.07077 Apple iOS for a complete list of resolved issues.

Cisco recommends that you upgrade to this release of AnyConnect if your device supports iOS 10, and review the Known Issues and Limitations to be aware of current operational considerations.

This update of AnyConnect is a maintenance release for devices running earlier versions. See for a complete list of resolved issues.

Cisco recommends that you upgrade to this release of AnyConnect if your device supports iOS 10, and review the Known Issues and Limitations to be aware of current operational considerations.

This update of AnyConnect is a maintenance release for devices running earlier versions. See Resolved Issues in AnyConnect 4.0.07074 Apple iOS for a complete list of resolved issues.

Cisco recommends that you upgrade to this release of AnyConnect if your device supports iOS 10, and review the Known Issues and Limitations to be aware of current operational considerations.

This release of Cisco AnyConnect is the latest and recommended version available for Apple iOS. This version supports iOS 10.3 and later. It uses the New Extension Framework, provided by iOS, to implement VPN and all its features. During the Beta cycle this version of AnyConnect was named AnyConnect 2017. In addition to the new framework, Per App tunneling, described below, is now fully supported in this release.

Note	Certificates imported using Legacy AnyConnect version 4.0.05069 and any earlier release cannot be accessed or used by the new AnyConnect app release 4.0.07072 or later. MDM deployed certificates can be accessed and used by both app versions.

Moving forward, this Cisco AnyConnect version will be the only one to contain all enhancements and bug fixes. It will be numbered 4.0.07xxx.

This update of AnyConnect is also a maintenance release for devices running earlier versions. See Resolved Issues in AnyConnect 4.0.07072 Apple iOS for a complete list of resolved issues.

Cisco recommends that you upgrade to this release of AnyConnect if your device supports iOS 10, and review the Known Issues and Limitations to be aware of current operational considerations.

Per App VPN

This version of AnyConnect is now named Legacy AnyConnect.

Legacy AnyConnect is the version supporting Apple iOS 6.0 and later that has been on the app store for some time now. It remains available to ease the transition to the latest and recommended version of Cisco AnyConnect.

Legacy AnyConnect will only be updated for critical customer issues that cannot be solved by upgrading to the latest release. This release continues to be numbered 4.0.05x. See New Features in Legacy AnyConnect 4.0.05x for Apple iOS.

This update of AnyConnect is also a maintenance release for devices running earlier versions. See Resolved Issues in Legacy AnyConnect 4.0.05069 Apple iOS for a complete list of Resolved Issues.

Cisco recommends that you upgrade to this release of AnyConnect only if your device DOES NOT support iOS 10. Review the Known Issues and Limitations to be aware of current operational considerations.

This update of AnyConnect is a maintenance release for devices running earlier versions. See Resolved Issues in AnyConnect 4.0.05066 Apple iOS for a complete list of Resolved Issues.

Cisco recommends that you upgrade to this latest release of AnyConnect and review the Known Issues and Limitations to be aware of current operational considerations.

Note	Email questions and feedback related to the Per App VPN Beta feature to ac-mobile-feedback@cisco.com directly, do not raise them to the Cisco TAC.

This release of Cisco AnyConnect for Apple iOS updates the support of the Disconnect on Suspend, Auto Reconnect Behavior introduced in the previous release.

Now, when Disconnect On Suspend is chosen, AnyConnect disconnects and releases the resources assigned to the VPN session when the device sleeps, for On Demand connections ONLY. Once disconnected in this way, AnyConnect will reconnect only in response to a user's manual connection or an On Demand connection (if configured).

This update of AnyConnect is also a maintenance release for devices running earlier versions. See Resolved Issues in AnyConnect 4.0.05055 Apple iOS for a complete list of Resolved Issues.

Cisco recommends that you upgrade to this latest release of AnyConnect and review the Known Issues and Limitations to be aware of current operational considerations.

Note	Email questions and feedback related to the Per App VPN Beta feature to ac-mobile-feedback@cisco.com directly, do not raise them to the Cisco TAC.

This release of Cisco AnyConnect for Apple iOS now supports the Disconnect on Suspend, Auto Reconnect Behavior if selected by the administrator in the VPN Client Profile. When Disconnect On Suspend is chosen, AnyConnect disconnects and releases the resources assigned to the VPN session when the device sleeps. It will reconnect only in response to a user's manual connection or an On Demand connection (if configured).

This update of AnyConnect is also a maintenance release for devices running earlier versions. See Resolved Issues in AnyConnect 4.0.05052 Apple iOS for a complete list of Resolved Issues.

Cisco recommends that you upgrade to this latest release of AnyConnect and review the Known Issues and Limitations to be aware of current operational considerations.

Note	Email questions and feedback related to the Per App VPN Beta feature to ac-mobile-feedback@cisco.com directly, do not raise them to the Cisco TAC.

This update of Cisco AnyConnect Secure Mobility Client for Apple iOS devices addresses the most recent OpenSSL vulnerabilities. It is also a maintenance release for devices running earlier versions. See Resolved Issues in AnyConnect 4.0.05046 Apple iOS for a complete list of Resolved Issues.

Cisco recommends that you upgrade to this latest release of AnyConnect and review the Known Issues and Limitations to be aware of current operational considerations.

Note	Email questions and feedback related to the Per App VPN Beta feature to ac-mobile-feedback@cisco.com directly, do not raise them to the Cisco TAC.

This version of AnyConnect for Apple iOS is a maintenance release to address regressions in 4.0.05036. See Resolved Issues in AnyConnect 4.0.05038 Apple iOS for details.

Note	Email questions and feedback related to the Per App VPN Beta feature to ac-mobile-feedback@cisco.com directly, do not raise them to the Cisco TAC.

Cisco recommends that you upgrade to this latest release of AnyConnect and review the Known Issues and Limitations to be aware of current operational considerations.

This version of AnyConnect for Apple iOS is a maintenance release to address a regression in 4.0.05032. See Resolved Issues in AnyConnect 4.0.05036 Apple iOS for details.

Note	Email questions and feedback related to the Per App VPN Beta feature to ac-mobile-feedback@cisco.com directly, do not raise them to the Cisco TAC.

Cisco recommends that you upgrade to this latest release of AnyConnect and review the Known Issues and Limitations to be aware of current operational considerations.

This release of AnyConnect 4.0 now supports: public IPv6 tunneling and private IPv6 split tunneling.

Also, the following limitation has been removed for devices running AnyConnect 4.0.05032 or later, in conjunction with Apple iOS 9.3 or later: After upgrading, if the Apple iOS Connect On Demand feature is used on your device to make VPN connections automatically, you must launch the AnyConnect app and establish a VPN connection. If this is not done, upon the next iOS system attempt to establish a VPN tunnel, the error message “The VPN Connection requires an application to start up” will display.

Note	Questions and feedback related to the Per App VPN Beta feature should be mailed to ac-mobile-feedback@cisco.com directly, not raised to the Cisco TAC

Cisco recommends that you upgrade to this latest release of AnyConnect and review the Known Issues and Limitations to be aware of current operational considerations.

This release of AnyConnect 4.0 is an upgrade for Apple iOS devices running earlier versions of AnyConnect. It resolves the latest Open SSL vulnerabilities and addresses other issues. See Resolved Issues in AnyConnect 4.0.03021 Apple iOS for details.

Note	Questions and feedback related to the Per App VPN Beta feature should be mailed to ac-mobile-feedback@cisco.com directly, not raised to the Cisco TAC

Cisco recommends that you upgrade to this latest release of AnyConnect and review the Known Issues and Limitations to be aware of current operational considerations.

This release of AnyConnect 4.0 is an upgrade for Apple iOS devices running earlier versions of AnyConnect. It resolves the latest Open SSL vulnerabilities and addresses issues seen in the initial release of 4.0. See Resolved Issues in AnyConnect 4.0.03016 for Apple iOS for details.

Note	Questions and feedback related to the Per App VPN Beta feature should be mailed to ac-mobile-feedback@cisco.com directly, not raised to the Cisco TAC

Cisco recommends that you upgrade to this latest release of AnyConnect and review the Known Issues and Limitations to be aware of current operational considerations.

This release of AnyConnect 4.0 is an upgrade for Apple iOS devices running earlier versions of AnyConnect. It resolves the latest Open SSL vulnerabilities and addresses issues seen in the initial release of 4.0. See Resolved Issues in AnyConnect 4.0.03004 for Apple iOS for details.

Note	Questions and feedback related to the Per App VPN Beta feature should be mailed to ac-mobile-feedback@cisco.com directly, not raised to the Cisco TAC.

Cisco recommends that you upgrade to this latest release of AnyConnect and review the Known Issues and Limitations to be aware of current operational considerations.

This release of AnyConnect 4.0 is an upgrade for Apple iOS devices running earlier versions of AnyConnect and contains the following new features described below:

• TLS 1.2

• Additional Localization

• Per App VPN (Beta availability and support only)

  Note	Questions and feedback related to this feature should be mailed to ac-mobile-feedback@cisco.com directly, not raised to the Cisco TAC.

Cisco recommends that you upgrade to this latest release of AnyConnect. Review the Known Issues and Limitations to be aware of current operational considerations.

TLS 1.2

AnyConnect 4.0 now supports TLS version 1.2 with the following additional cipher suites:

• DHE-RSA-AES256-SHA256

• DHE-RSA-AES128-SHA256

• AES256-SHA256

• AES128-SHA256

Note	AnyConnect TLS 1.2 requires a secure gateway that also supports TLS 1.2. This is available in release 9.3(2) of the ASA on 5500-X models.

Additional Localization

AnyConnect 4.0 for mobile devices now includes the following additional language translations in the AnyConnect Apple iOS app:

• Chinese (Taiwan) (zh-tw)

• Dutch (nl-nl)

• French (fr-fr)

• Hungarian (hu-hu)

• Italian (it-it)

• Portuguese (Brazil) (pt-br)

• Russian (ru-ru)

• Spanish (es-es)

See Localization on Mobile Devices in the Cisco AnyConnect Secure Mobility Client Administrator Guide, Release 4.0 for mobile localization options and details.

Per App VPN Tunneling

AnyConnect 4.0 for mobile devices has been enhanced to provide Per App VPN tunneling in addition to traditional system-tunneling. Per App VPN tunneling requires:

• Apple iOS 8.3 or later

• Devices must be configured to use Per App using a Mobile Device Management (MDM) solution.

• ASA 9.3.2 or later to configure Per App VPN tunneling.

• An AnyConnect v4.0 Plus or Apex license.

  Note	AnyConnect Essentials or Premium licenses do not support Per App VPN. Customers with Premium or Essentials licenses are eligible for AnyConnect 4.0 migration licenses, see the Cisco AnyConnect Ordering Guide for details.

AnyConnect determines which mode it operates in based on configuration information received from the ASA headend. Specifically, the presence or absence of a Per App VPN custom attribute in the Group Policy or Dynamic Access Policy (DAP) associated with the connection when the session is being established. If the Per App VPN list is present, AnyConnect operates in Per App VPN mode; if it is absent, AnyConnect operates in system-tunneling mode.

In AnyConnect 4.6.xxxxx

• Split tunneling to the ASA headend does not work when tunneling IPv6 only (no IPv4 address assigned) in a split exclude configuration.

  All traffic should be tunneled except for the exclude list entries, yet the split exclude list is not honored, all IPv6 traffic is excluded. Refer to CSCvb80768: IPv6 Split Exclude & IPv4 DropAll will exclude all v6 traffic from the tunnel. (RADAR 29623849).

• If the AnyConnect UI remains open and iOS mistakenly disconnects the Inter-Process Communication (IPC) between the UI and the internal AnyConnect extension, any UI activity will fail with an error or an incorrect response.

  To recover from this, you must close and restart the AnyConnect UI which will re-establish the IPC. If the unexpected IPC disconnect occurs when the UI is closed, the next time you open the UI, it will be re-established. Refer to CSCvb95722: Fails to get to Paused state (RADAR 29313229).

• For On Demand connections, the AnyConnect UI must be opened when an updated VPN connection profile has been pushed to the client by the ASA. If the UI is not opened, the updated profile will not be synchronized and therefore the changes will not be used.

  Unfortunately, there is no indication to the user to open the UI to sync the new profile (as in Legacy AnyConnect), so it is possible that the updated connection entry is never used. There is no workaround at this time. Refer to CSCvc35923: Using On-Demand AC cannot inform users that they must open AC to sync an updated connection profile (RADAR 30173053).

• In a managed Per App configuration, app traffic, configured for Per App, flows over a user-created (unmanaged) VPN connection when it should not.

  Refer to CSCvc36024: PerApp - Apps can pass traffic over non-PAV full tunnel (RADAR 29513803).

AnyConnect for Apple iOS supports only features that are related to remote VPN access such as:

• AnyConnect can be configured by the user (manually), by the AnyConnect VPN Client Profile, generated by the iPhone Configuration Utility (http://www.apple.com/support/iphone/enterprise/), or using an Enterprise Mobile Device Manager.

• The Apple iOS device supports no more than one AnyConnect VPN client profile. The contents of the generated configuration always match the most recent profile. For example, you connect to vpn.example1.com and then to vpn.example2.com, the AnyConnect VPN client profile imported from vpn.example2.com replaces the one imported from vpn.example1.com.

• This release supports the tunnel keepalive feature; however, it reduces battery life of the device. Increasing the update interval value mitigates this issue.

Apple iOS Connect On-Demand Considerations:

• VPN sessions, which are automatically connected as a result of iOS On-Demand logic and have Disconnect on Suspend configured, are disconnected when the device sleeps. After the device wakes up, On-Demand logic will reconnect the VPN session when it is necessary again.

• AnyConnect collects device information when the UI is launched and a VPN connection is initiated. Therefore, there are circumstances in which AnyConnect can misreport mobile posture information if the user relies on iOS’s Connect On-Demand feature to make a connection initially, or after device information, such as the OS version has changed.

• This only applies in your environment if you are running a Legacy AnyConnect release earlier than 4.0.05032, or an Apple iOS release earlier than 9.3 while using Apple Connect-on-Demand capabilities. To ensure proper establishment of Connect On-Demand VPN tunnels after updating AnyConnect, users must manually start the AnyConnect app and establish a connection. If this is not done, upon the next iOS system attempt to establish a VPN tunnel, the error message “The VPN Connection requires an application to start up” displays.

Cisco AnyConnect and Legacy AnyConnect are different apps with different app IDs. Hence:

• Using the new extension framework in AnyConnect 4.0.07x (and later) causes the following changes in behavior from legacy AnyConnect 4.0.05x: AnyConnect considers traffic for tunnel DNS server to be tunneled, even if it is not in split-include network.

• You cannot upgrade the AnyConnect app from a legacy 4.0.05x or earlier version to AnyConnect 4.0.07x or 4.6.x (or later). Cisco AnyConnect 4.0.07x (or 4.6.x and later) is a separate app, installed with a different name and icon.

• The different versions of AnyConnect can co-exist on the mobile device, but this is not supported by Cisco. The behavior may not be as expected if you attempt to connect while having both versions of AnyConnect installed. Make sure you have only one AnyConnect app on your device, and it is the appropriate version for your device and environment.

• Certificates imported using Legacy AnyConnect version 4.0.05069 and any earlier release cannot be accessed or used by the new AnyConnect app release 4.0.07072 or later. MDM deployed certificates can be accessed and used by both app versions.

• App data imported to the Legacy AnyConnect app, such as certificates and profiles, should be deleted if you are updating to the new version. Otherwise they will continue to show in the system VPN settings. Remove app data before uninstalling the Legacy AnyConnect app.

• Current MDM profiles will not trigger the new app. EMM vendors must support VPNType (VPN), VPNSubType (com.cisco.anyconnect) and ProviderType (packet-tunnel). For integration with ISE, they must be able to pass the UniqueIdentifier to AnyConnect since AnyConnect no longer has access to this in the new framework. Consult your EMM vendor for how to set this up; some may require a custom VPN type, and others may not have support available at release time.

Using the New Extension Framework in AnyConnect 4.0.07x and later causes the following changes in behavior from Legacy AnyConnect 4.0.05x:

• The Device ID sent to the head end is no longer the UDID in the new version, and it is different after a factory reset unless your device is restored from a backup made by the same device.

• You may use MDM deployed certificates, as well as certificates imported using one of the methods available in AnyConnect: SCEP, manually through the UI, or via the URI handler. The new version of AnyConnect can no longer use certificates imported via email or any other mechanism beyond these identified ones.

• When creating a connection entry using the UI, the user must accept the iOS security message displayed.

• A user-created entry with the same name as a downloaded host entry from the AnyConnect VPN profile will not be renamed until it disconnects, if it is active. Also, the downloaded host connection entry will appear in the UI after this disconnect, not while it remains connected.

• AnyConnect considers traffic for tunnel DNS server to be tunneled even if it is not in split-include network.