Cisco AnyConnect 4.10 is the latest and recommended version available on all iPhones, iPads, and iPod Touch devices running Apple iOS 10.3 and later.

If a device does not support Apple iOS 10.3 or later, only Legacy AnyConnect 4.0.05x , available on all iPhones, iPads, and iPod Touch devices running Apple iOS 6.0 and later, can be used. Per App tunneling in Legacy AnyConnect requires Apple iOS 8.3 or later.

Note	AnyConnect on the iPod Touch appears and operates as on the iPhone.

* Local LAN access is enabled for iOS devices regardless of the configuration of the ASA due to operating system implementation.

A minimum release of the ASA is required for the following features:

Note	Refer to the feature matrix for your platform to verify the availability of these features in the current AnyConnect mobile release.

• You must upgrade to ASA 9.7.1.24, 9.8.2.28, 9.9.2.1 or later to use the SAML authentication feature. Make sure that both the client and server versions are up-to-date.

• You must upgrade to ASA 9.3.2 or later to use TLS 1.2.

• You must upgrade to ASA 9.3.2 or later to use Per App VPN tunneling mode.

• You must upgrade to ASA 9.0 to use the following mobile features:

  • IPsec IKEv2 VPN

  • Suite B cryptography

  • SCEP Proxy

  • Mobile Posture

• ASA Release 8.0(3) and Adaptive Security Device Manager (ASDM) 6.1(3) are the minimum releases that support AnyConnect for mobile devices.

AnyConnect SSL connectivity is supported on Cisco IOS 15.3(3)M+/15.2(4)M+.

AnyConnect IKEv2 connectivity is supported on Cisco ISR g2 15.2(4)M+

AnyConnect SSL and IKEv2 is supported on Cisco Firepower Threat Defense, release 6.2.1 and later.

• (iOS 14.0.x only)—When tunnel DNS servers are configured without a split DNS domain name specified, failure to resolve an address with the tunnel DNS servers does not result in a fallback to the device's public DNS servers. Changes in iOS caused this different behavior.

• (iOS 14.0.x only) CSCvv50495—After a network change, a transition from one network to another, or a network pause and resume, traffic stops. You can disable and re-enable your VPN connection to resume. This issue is fixed in iOS 14.1.

• CSCvs82209—While accessing client certificates that are imported via SCEP and that require biometrics for access, a "no valid certificate found" error results on iOS 13.3.1 and later. iOS 13.3.1 removed the ability for the AnyConnect Network Extension to use SCEP-imported certificates that have the security property requiring biometrics (TouchID / FaceID / passcode) for access. Until the client can be redesigned to accommodate this change, deploy certificates using SCEP without the biometric option.

• AnyConnect can be configured by the user (manually), by the AnyConnect VPN Client Profile, generated by the iPhone Configuration Utility (http://www.apple.com/support/iphone/enterprise/), or using an Enterprise Mobile Device Manager.

• The Apple iOS device supports no more than one AnyConnect VPN client profile. The contents of the generated configuration always match the most recent profile. For example, if you connect to vpn.example1.com and then to vpn.example2.com, the AnyConnect VPN client profile imported from vpn.example2.com replaces the one imported from vpn.example1.com.

• This release supports the tunnel keepalive feature; however, it reduces battery life of the device. Increasing the update interval value mitigates this issue.

• DHE Incompatibility

  With the introduction of DHE cipher support in AnyConnect release 4.6, incompatibility issues result in ASA versions before ASA 9.2. If you are using DHE ciphers with ASA releases earlier than 9.2, you must disable DHE ciphers on those ASA versions.

Apple iOS Connect On-Demand Considerations:

• VPN sessions, which are automatically connected as a result of iOS On-Demand logic and have Disconnect on Suspend configured, are disconnected when the device sleeps. After the device wakes up, On-Demand logic will reconnect the VPN session when it is necessary again.

• AnyConnect collects device information when the UI is launched, and a VPN connection is initiated. Therefore, there are circumstances in which AnyConnect can misreport mobile posture information if the user relies on iOS’s Connect On-Demand feature to make a connection initially, or after device information, such has the OS version has changed.

• Only applies in your environment if you are running a Legacy AnyConnect release earlier than 4.0.05032, or an Apple iOS release earlier than 9.3 while using Apple Connect-on-Demand capabilities. To ensure proper establishment of Connect On-Demand VPN tunnels after updating AnyConnect, users must manually start the AnyConnect app and establish a connection. If this is not done, the error message “The VPN Connection requires an application to start up” displays, upon the next iOS system attempt to establish a VPN tunnel.

Cisco AnyConnect and Legacy AnyConnect are different apps with different app IDs. Hence:

• You cannot upgrade the AnyConnect app from a legacy 4.0.05x or earlier version to the new version. The newer versions are separate apps, installed with a different name and icon.

• The different versions of AnyConnect can co-exist on the mobile device, but this is not supported by Cisco. The behavior may not be as expected if you attempt to connect while having both versions of AnyConnect installed. Make sure you have only one AnyConnect app on your device, and it is the appropriate version for your device and environment.

• Certificates imported using Legacy AnyConnect version 4.0.05069 and any earlier release cannot be accessed or used by the new AnyConnect app release 4.0.07072 or later. MDM deployed certificates can be accessed and used by both app versions.

• App data imported to the Legacy AnyConnect app, such as certificates and profiles, should be deleted if you are updating to the new version. Otherwise they will continue to show in the system VPN settings. Remove app data before uninstalling the Legacy AnyConnect app.

• Current MDM profiles will not trigger the new app. EMM vendors must support VPNType (VPN), VPNSubType (com.cisco.anyconnect) and ProviderType (packet-tunnel). For integration with ISE, they must be able to pass the UniqueIdentifier to AnyConnect since AnyConnect no longer has access to this in the new framework. Consult your EMM vendor for how to set this up; some may require a custom VPN type and others may not have support available at release time.

Using the New Extension Framework in AnyConnect 4.6.x and later causes the following changes in behavior from Legacy AnyConnect 4.0.05x:

• The Device ID sent to the head end is no longer the UDID in the new version, and it is different after a factory reset unless your device is restored from a backup made by the same device.

• You may use MDM deployed certificates, as well as certificates imported using one of the methods available in AnyConnect: SCEP, manually through the UI, or via the URI handler. The new version of AnyConnect can no longer use certificates imported via email or any other mechanism beyond these identified ones.

• When creating a connection entry using the UI, the user must accept the iOS security message displayed.

• A user-created entry with the same name as a downloaded host entry from the AnyConnect VPN profile will not be renamed until it disconnects, if it is active. Also, the downloaded host connection entry will appear in the UI after this disconnect, not while it remains connected.

In AnyConnect 4.7.xxxxx and later

• Split tunneling to the ASA headend does not work when tunneling IPv6 only (no IPv4 address assigned) in a split exclude configuration.

  All traffic should be tunneled except for the exclude list entries, yet the split exclude list is not honored, and all IPv6 traffic is excluded. Refer to CSCvb80768: IPv6 Split Exclude & IPv4 DropAll will exclude all v6 traffic from the tunnel. (RADAR 29623849).

• If the AnyConnect UI remains open and iOS mistakenly disconnects the Inter-Process Communication (IPC) between the UI and the internal AnyConnect extension, any UI activity fails with an error or an incorrect response.

  To recover from this, you must close and restart the AnyConnect UI which will re-establish the IPC. If the unexpected IPC disconnect occurs when the UI is closed, the next time you open the UI, it will be re-established. Refer to CSCvb95722: Fails to get to Paused state (RADAR 29313229).

• For On Demand connections, the AnyConnect UI must be opened when an updated VPN connection profile has been pushed to the client by the ASA. If the UI is not opened, the updated profile will not be synchronized and therefore the changes will not be used.

  Unfortunately, there is no indication to the user to open the UI to sync the new profile (as in Legacy AnyConnect), so it is possible that the updated connection entry is never used. There is no workaround at this time. Refer to CSCvc35923: Using On-Demand AC cannot inform users that they must open AC to sync an updated connection profile (RADAR 30173053).

• In a managed Per App configuration, app traffic, configured for Per App, flows over a user-created (unmanaged) VPN connection when it should not.

  Refer to CSCvc36024: PerApp - Apps can pass traffic over non-PAV full tunnel (RADAR 29513803).

As of AnyConnect release 4.9, these less secure cipher suites have been removed:

• For SSL VPN, AnyConnect no longer supports the following cipher suites from both TLS and DTLS: DHE-RSA-AES256-SHA and DES-CBC3-SHA

• For IKEv2/IPsec, AnyConnect no longer supports the following algorithms:

  • Encryption algorithms: DES and 3DES

  • Pseudo Random Function (PRF) algorithm: MD5

  • Integrity algorithm: MD5

  • Diffie-Hellman (DH) groups: 2, 5, 14, 24