Full support for Cisco AnyConnect on Android is provided on devices running Android 4.0 (Ice Cream Sandwich) through the latest release of Android.

AnyConnect for Kindle Fire HD is available from Amazon for the Kindle Fire HD devices, and the New Kindle Fire. AnyConnect for Kindle is equivalent in functionality to the AnyConnect for Android package.

Per App VPN is supported in managed and unmanaged environments. In a managed environment using Samsung KNOX MDM, Samsung devices running Android 4.3 or later with Samsung Knox 2.0, are required. When using Per App in an unmanaged environment, the generic Android methods are used.

For the Network Visibility Module (NVM) capabilities, Samsung devices that are running Samsung Knox 2.8 or later (including 3.3), which requires Android 7.0 or later, are required. For configuration of NVM, the AnyConnect Profile Editor from AnyConnect 4.4.3 or later is also required. Earlier releases do not support mobile NVM configurations.

See the Android User Guide for Cisco AnyConnect Secure Mobility Client for installation and upgrade procedures.

In release 4.8.03645, Android offers the Cisco Umbrella module for AnyConnect for Android 6.0.1 and later devices. This roaming client for managed Android devices provides DNS-layer protection, and this protection extends to both apps and browsing covered by the work profile.

A mobile device management system (MDM) is required to deploy this client to Android devices and to push the Umbrella configuration to the Android devices. For a list of supported MDMs and other prerequisites, see Prerequisites for Deploying the Umbrella Module for AnyConnect on Android OS.

Some features may have limitations in functionality:

• Per-app VPN does not work with the Umbrella Module because of OS restrictions. If remote access VPN is active, Umbrella protection will only apply to DNS traffic that is intercepted by the VPN tunnel. If remote access is configured for per-app VPN, Umbrella protection only applies to DNS traffic for the tunneled applications.

• Always-On VPN should not be used with the lockdown (Fail Close) option when using Umbrella protection because it stops internet access for the user when the VPN server is not reachable. Refer to your MDM guide to turn off the lockdown setting when Always-On is turned on.

For an explanation of the complete Umbrella feature set, refer to the Umbrella Module for AnyConnect (Android OS) documentation.

The following table indicates the remote access features that are supported by Cisco AnyConnect on Android:

A minimum release of the ASA is required for the following features:

Note	Refer to the feature matrix for your platform to verify the availability of these features in the current AnyConnect mobile release.

• You must upgrade to ASA 9.7.1.24, 9.8.2.28, 9.9.2.1 or later to use the SAML authentication feature. Make sure that both the client and server versions are up-to-date.

• You must upgrade to ASA 9.3.2 or later to use TLS 1.2.

• You must upgrade to ASA 9.3.2 or later to use Per App VPN tunneling mode.

• You must upgrade to ASA 9.0 to use the following mobile features:

  • IPsec IKEv2 VPN

  • Suite B cryptography

  • SCEP Proxy

  • Mobile Posture

• ASA Release 8.0(3) and Adaptive Security Device Manager (ASDM) 6.1(3) are the minimum releases that support AnyConnect for mobile devices.

• The ASA does not provide distributions and updates for AnyConnect for Android. They are available only on Google Play.

• AnyConnect for Android supports only the Network Visibility Module, it does not support any other AnyConnect modules.

• The Android device supports no more than one AnyConnect profile, which is the last one received from a headend. However, a profile can consist of multiple connection entries.

• If users attempt to install AnyConnect on devices that are not supported, they receive the pop-up messageInstallation Error: Unknown reason -8. This message is generated by the Android OS.

• When users have an AnyConnect widget on their home screen, the AnyConnect services are automatically started (but not connected) regardless of the "Launch at startup" preference.

• AnyConnect for Android requires UTF-8 character encoding for extended ASCII characters when using pre-fill from client certificates. The client certificate must be in UTF-8 if you want to use prefill, per the instructions in KB-890772 and KB-888180.

• AnyConnect blocks voice calls if it is sending or receiving VPN traffic over an EDGE connection per the inherent nature of EDGE and other early radio technology.

• Some known file compression utilities do not successfully decompress log bundles packaged with the use of the AnyConnect Send Log button. As a workaround, use the native utilities on Windows and Mac OS X to decompress AnyConnect log files.

• DHE Incompatibility

  With the introduction of DHE cipher support in AnyConnect release 4.6, incompatibility issues result in ASA versions before ASA 9.2. If you are using DHE ciphers with ASA releases earlier than 9.2, you must disable DHE ciphers on those ASA versions.

Cisco highly recommends that all users run the current version of our Android release, which is available on the Google play store. Additionally, an .apk version is available on Cisco.com for the current version only. In the unlikely event that the Google play store is unavailable, administrators who have access to the AnyConnect software download page can get this version.

• If you are experiencing connectivity issues with the VPN tunnel on Android 10, try disabling Android 10 Private DNS functionality.

• IPv6 on public and private interfaces.

  IPv6 is supported on both private and public transports using AnyConnect 4.05015 and later, on Android 5 and later. With this combination the following is now allowed: IPv4 over an IPv6 tunnel, IPv6 over an IPv6 tunnel.

  This is in addtion to the previously allowed tunnel configuratons on earlier AnyConnect and Android releases: IPv4 over an IPv4 tunnel, and IPv6 over an IPv4 tunnel.

  Note	Due to Google issue 65572, IPv6 over IPv4 does not work on Android 4.4. You must use Android 5 or later.

• Battery saver and AnyConnect:

  • Android 5.0 introduced battery saver capabilities that block background network connectivity on your device. When battery saver is enabled, AnyConnect will transition to the Paused state if it is in the background. To work around this on Android 5.0, users may turn off battery saver via the device settings: Settings -> Battery -> Battery saver or from the notification bar.

  • In Android 6.0+, when AnyConnect transitions to the Paused state as a result of battery saver, you see a popup with the option to make AnyConnect part of the allowed list from battery saver mode. Making AnyConnect part of the allowed list provides a battery savings without impacting AnyConnect’s ability to run in the background.

  • Once AnyConnect is paused due to the batter saver, a manual reconnect is necessary to bring AnyConnect out of the Paused state, regardless of your action to turn off battery saver or to add AnyConnect to the allowed list.

• Split DNS does not work on any Android 4.4 device, and also does not work on Samsung 5.x Android devices. For Samsung devices, the only workaround is to connect to a group with split DNS disabled. On other devices you must upgrade to Android 5.x to receive the fix for this problem.

  This is due to a known issue that is present in Android 4.4 ( Issue #64819), fixed in Android 5.x, but not incorporated into Samsung 5.x android devices.

• Due to a bug in Android 5.x (Google Issue #85758, Cisco Issue # CSCus38925), if the AnyConnect app is closed from the recent apps screen it may not operate properly. To restore proper operation, terminate AnyConnect in Settings and then restart it.

• On Samsung mobile devices the Settings > Wi-Fi > Smart network switch allows switching from WIFI to LTE to maintain a stable Internet connection (when the Wi-Fi connection is not optimum). This also results in a pause and reconnect of the active VPN tunnel. Cisco recommends turning this off, since it may result in continuous reconnects.

• On Android 5.0 (Lollipop), which supports multiple active users, the VPN connection tunnels data for a single user only, not for all users on the device. Background data flow may be occurring in the clear.

• Due to a bug in Android 4.3.1(Google Issue #62073), users using the AnyConnect ICS+ package cannot enter non-fully qualified domain names. For example, users cannot type "internalhost", they must type "internalhost.company.com."

• The AT&T firmware updates on HTC One to Android 4.3 (software version: 3.17.502.3) do not support "HTC AnyConnect." Customers must uninstall "HTC AnyConnect", and install "AnyConnect ICS+." (HTC AnyConnect will work on the international edition, with software version of 3.22.1540.1). Check your software version on your device at Settings > About > Software information > Software number.

• We are pleased to report that Google Issue #70916, VPN connections will fail to connect if the administrator has set the MTU for Android tunnels lower than 1280, has been resolved in Android 5.0 (Lollipop). The following problem information is provided for reference:

  Due to a regression in Android 4.4.3,( Google Issue #70916, Cisco CSCup24172), VPN connections will fail to connect if the administrator has set the MTU for Android tunnels lower than 1280. This issue has been reported to Google and will require a new version of the OS to correct the regression introduced in Android 4.4.3. To workaround this problem, ensure that the head-end administrator has not configured the tunnel MTU to be lower than 1280.

  When encountered, the message displayed to the end user is: System configuration settings could not be applied. A VPN connection will not be established, and AnyConnect debug logs will report:

  
  E/vpnandroid( 2419): IPCInteractionThread: NCSS: General Exception occured, telling client
  E/vpnandroid( 2419): java.lang.IllegalStateException: command '181 interface fwmark rule add tun0' 
  failed with '400 181 Failed to add fwmark rule (No such process)'
  E/vpnandroid( 2419): at android.os.Parcel.readException(Parcel.java:1473)
  E/vpnandroid( 2419): at android.os.Parcel.readException(Parcel.java:1419)
  E/vpnandroid( 2419): at 
  com.cisco.android.nchs.aidl.IICSSupportService$Stub$Proxy.establish
  (IICSSupportService.java:330)
  E/vpnandroid( 2419): at com.cisco.android.nchs.support.VpnBuilderWrapper.establish
  (VpnBuilderWrapper.java:137)
  E/vpnandroid( 2419): at com.cisco.android.nchs.support.NCSSIPCServer.callServiceMethod
  (NCSSIPCServer.java:233)
  E/vpnandroid( 2419): at 
  com.cisco.android.nchs.ipc.IPCInteractionThread.handleClientInteraction
  (IPCInteractionThread.java:230)
  E/vpnandroid( 2419): at com.cisco.android.nchs.ipc.IPCInteractionThread.run
  (IPCInteractionThread.java:90)
  E/acvpnagent( 2450): Function: ApplyVpnConfiguration 
  File: NcssHelper.cpp Line: 740 failed to establish VPN
  E/acvpnagent( 2450): Function: PluginResult AndroidSNAKSystem::configDeviceForICS() 
  File: AndroidSNAKSystem.cpp Line: 665 failed to apply vpn configuration
  E/acvpnagent( 2450): Function: virtual PluginResult AndroidSNAKSystem::ApplyConfiguration() 
  File: AndroidSNAKSystem.cpp Line: 543 Failed to Configure System for VPN.

• We are pleased to report that Android 4.4 (KitKat) bug Google Issue #61948 (AnyConnect users will experience High Packet Loss over their VPN connection /users will experience timeouts) has been resolved in Google's release of Android 4.4.1 which Google has begun distributing to some devices via Software Update. The following problem information is provided for reference:

  Due to a bug in Android 4.4 (Issue #61948, also see the Cisco Support Update), AnyConnect users will experience High Packet Loss over their VPN connection. This has been seen on the Google Nexus 5 running Android 4.4 with AnyConnect ICS+. Users will experience timeouts when attempting to access certain network resources. Also, in the ASA logs, a syslog message will appear with text similar to "Transmitting large packet 1420 (threshold 1405)."

  Until Google produces a fix for Android 4.4, VPN administrators may temporarily reduce the maximum segment size for TCP connections on the ASA by configuring the following sysopt connection tcpmss <mss size>. The default for this parameter is 1380 bytes. Reduce this value by the difference between the values seen in the ASA logs. In the above example, the difference is 15 bytes; the value should thus be no more than 1365. Reducing this value will negatively impact performance for connected VPN users where large packets are transmitted.

• AnyConnect for Android may have connectivity issues when connecting to a mobile network using the IPv6 transition mechanism known as 464xlat. Known affected devices include the Samsung Galaxy Note III LTE connecting to the T-Mobile US network. This device defaults to an IPv6 only mobile network connection. Attempting a connection may result in a loss of mobile connectivity until the device is rebooted.

  To prevent this problem, use the AnyConnect ICS+ app, and change your device settings to obtain IPv4 network connectivity or connect using a Wi-Fi network. For the Samsung Galaxy Note III LTE connecting to the T-Mobile US network, follow the instructions provided by T-Mobile to set the Access Point Name (APN) on your device, making sure APN Protocol is set to IPv4.

• The AnyConnect ICS+ package may have issues when a private IP address range within the VPN overlaps with the range of the outside interface of the client device. When this route overlap occurs, the user may be able to successfully connect to the VPN but then be unable to actually access anything. This issue has been seen on cellular networks which use NAT (Network Address Translation) and assign addresses within the 10.0.0.0 - 10.255.255.255 range, and is due to AnyConnect having limited control of routes in the Android VPN framework. The vendor specific Android packages have full routing control and may work better in such a scenario.

• An Asus tablet running Android 4.0 (ICS) may be missing the tun driver. This causes AVF AnyConnect to fail.

• Android security rules prevent the device from sending and receiving multimedia messaging service (MMS) messages while a VPN connection is up. Most devices and service providers display a notification if you try to send an MMS message while the VPN connection is up. Android permits sending and receiving of messages when the VPN is not connected.

• Due to Google Isssue 41037 , when pasting text from the clipboard, a space is inserted in front of the text. In AnyConnect, when copying text such as a one time password, the user has to delete this erroneous white space.

For more information refer to the following documentation:

• AnyConnect Release Notes

• AnyConnect Administrator Guides

• Navigating the Cisco ASA Series Documentation