Cisco Security Expert

Jamey Heary

Previous Article Next Article

Cisco Releases IPSEC & SSLVPN Client for Windows 7 and Snow Leopard

Cisco is First Major VPN Vendor to Support Win7/OSX 10.6 Clients

By jheary on Fri, 10/23/09 - 8:05pm.

Cisco just released support for the Windows 7 operating system in both its IPSEC client and SSLVPN client software. The Cisco Anyconnect 2.4 SSLVPN client now supports both 32bit and 64bit Windows 7 hosts. The new Anyconnect 2.4 client additionally supports MAC OSX 10.6.1 32 and 64bit operating systems as well. Cisco also released a Windows 7 32bit version of its widely deployed Cisco VPN client 5.0.6.

Neither client requires any changes at the head-end VPN concentrator/ASA.

You can download the new Anyconnect 2.4 client here

You can download the new Cisco IPSEC VPN client 5.0.6 here

Both download links will require a valid CCO account and valid Smartnet maintenance contract for access.

Here are the Anyconnect 2.4 release notes

Here are the Cisco VPN client 5.0.6 release notes

I've been using the Anyconnect 2.4 client on my MAC 10.6.1 OS for a few weeks now and it works great.

There are also some new features in the Anyconnect 2.4 client.

•Split DNS Fallback – You define domain names that should be tunneled through to the corporate DNS servers for resolution. All other DNS queries will be sent directly to the Internet DNS server configured on the client.

•Trusted Network Detection – Allows you to automatically bring up the vpn tunnel when a client is on a untrusted network. Conversely, when the client connects to a internal corporate trusted network the Anyconnect client will automatically disconnect. You define the trusted networks list.

•Simple Certificate Enrollment Protocol (SCEP) – You can now configure the Anyconnect client to provide automatic cert provisioning if the user fails certificate checking. The client will use SCEP to make this process easy. Or you can show a "Get Certificate" or an "Enroll" button to the user for manual certificate provisioning. Once they click on this button, Anyconnect uses the SCEP protocol to automatically provision a user certificate to them. It also has the ability to present the user with a challenge request for authentication to the CA Authority. Bottom line is this will make it way easier for you to start using certificates as a second factor auth method.

•Prompting Users to Select Authentication Certificate – Before this release the Anyconnect client would auto pick the best certificate. Now you have the option of providing a list of certificates to the end-user that they can choose from.

•Scripting – Very useful feature that allows you to run OnConnect scripts and OnDisconnect scripts on the host. You could run login scripts, drive mapping scripts, whatever you want using this new feature.

•New Proxy Support Enhancements

•PEM File Certificate Store – For MAC and Linux clients the AnyConnect client supports certificate authentication using a Privacy Enhanced Mail (PEM) formatted file store. Instead of relying on browsers to verify and sign certificates, the client reads PEM-formatted certificate files from the file system on the remote computer, and verifies and signs them.

•FIPS Compliant Anyconnect Solution

Have fun!

The opinions and information presented here are my PERSONAL views and not those of my employer. I am in no way an official spokesperson for my employer.

More from Jamey Heary:
* Credit Card Skimming: How thieves can steal your card info without you knowing it
* Why you should always shred your boarding pass
* Video rental records are afforded more privacy protections than your online data
* The truth about new SSL attacks
* 2009 Top Urban Legends in IT Security/a>

Go to Jamey’s Blog for more articles on security.