XenMobile Server and support for Cisco AnyConnect and Legacy AnyConnect clients

XenMobile Server and support for Cisco AnyConnect and Legacy AnyConnect clients

book

Article ID: CTX227708

calendar_today

Updated On:

Description

Last June 9 2017, Cisco announced the transition from the VPNPlugin (deprecated VPN framework) to the latest iOS VPN framework Network Extension in order to provide a more reliable connection to internal resources and support for UDP and TCP applications with Per-App VPN.

On June 14 2017, Cisco officially submitted the following versions to the AppStore:

  • Cisco Legacy AnyConnect (Current version: 4.0.05069 | Bundle ID: "com.cisco.anyconnect.gui"): this version is now known as Cisco Legacy AnyConnect and will be phased out over time. The newer Cisco AnyConnect application is now available as a separate download from the App Store. This Legacy AnyConnect version utilizes a deprecated VPN framework and will only receive critical bug fixes going forward
  • New Cisco AnyConnect (Current version: 4.0.7077​ | Bundle ID: "com.cisco.anyconnect"): This is the new AnyConnect application for Apple iOS. The application is supported by iOS 10 or later (Cisco recommends the latest version)
As stated in the Cisco Communities article, “Unfortunately there is no ability to automatically transition users from the old OS framework to the new framework. Users will need to download the newer AnyConnect application or have EMM push out the new AnyConnect application. The new application will need to be re-provisioned, whether manually or via EMM. This includes pushing down configuration and certificates (if applicable). To avoid confusion or conflicts, the old application should be removed from the endpoint.”
Important considerations for XenMobile Server

The new Cisco AnyConnect client will not detect the XenMobile Server VPN Device Policy with Connection type “Cisco AnyConnect”:
The reason behind this is the fact that Cisco changed both the framework and application BundleIDs for the AnyConnect clients.
The XenMobile Server VPN Device Policy with Connection type: “Cisco AnyConnect” was meant to support the former AnyConnect now known as Legacy AnyConnect.
Please see the screenshot:


AnyConnectVPNDP1

You can still configure both clients with XenMobile using VPN Device Policies:
  • For the Legacy Any Connect: our Product team is aware of the situation and the graphic interface element that currently shows Cisco AnyConnect will be updated to “Cisco AnyConnect (Legacy)” in a future release for better clarification. Having said that, you can still deploy this policy to your iOS devices using the Legacy application without issues.​
  • As for the new AnyConnect client: AnyConnect requires the following settings: 
    • VPNType: VPN
    • VPNSubType: com.cisco.anyconnect
    • ProviderType: packet-tunnel
XenMobile server supports these settings with the Custom SSL VPN connection type; the VPN Device Policy should be pushed with the following parameters to meet Cisco requirements:
  • Connection name: Cisco AnyConnect
  • Connection type: Custom SSL
  • Custom SSL identifier: com.cisco.anyconnect
  • Provider BundleID: com.cisco.anyconnect
  • Enable per-app VPN (optional): switch on or off depending on the use case 
  • Provider type: Packet tunnel
  • Other fields: depending on the use case
Please see the screenshot:

AnyConnectVPNDP2

XenMobile - Cisco Anyconnect iOS app name change breaks VPP sync:
Please reference the following CTX: https://support.citrix.com/article/CTX227494

Some additional Resources (see disclaimer)

AnyConnect Apple iOS - Transition to Apple's latest VPN framework (NetworkExtension): 
https://communities.cisco.com/community/technology/security/pa/anyconnect/blog/2017/06/09/anyconnect-apple-ios--transition-to-apples-latest-vpn-framework-networkextension

Cisco Legacy AnyConnect:
https://itunes.apple.com/us/app/cisco-legacy-anyconnect/id392790924?mt=8

New Cisco AnyConnect:
https://itunes.apple.com/us/app/cisco-anyconnect/id1135064690?mt=8

    Environment

    Citrix is not responsible for and does not endorse or accept any responsibility for the contents or your use of these third party Web sites. Citrix is providing these links to you only as a convenience, and the inclusion of any link does not imply endorsement by Citrix of the linked Web site. It is your responsibility to take precautions to ensure that whatever Web site you use is free of viruses or other harmful items.

    Issue/Introduction

    XenMobile Server and support for Cisco AnyConnect and Legacy AnyConnect clients with the VPN Device Policy

    Additional Information


     
    Powered by Wolken Software