This field configures the initial IP protocol and order of fallback. If the client cannot connect using IPv4, then try to make an IPv6 connection. If the client cannot connect using IPv6 then try to make an IPv4 connection. Whether performed prior to or during the VPN session, the failover is maintained until the currently used secure gateway IP address is no longer reachable. The client fails over to the IP address matching the alternate IP protocol, if available, whenever the currently used IP address address isn't reachable.

Disable Automatic Certificate Selection Windows only — Disables automatic certificate selection by the client and prompts the user to select the authentication certificate. Related Topics: Configure Certificate Selection.

Proxy Settings — Specifies a policy in the AnyConnect profile to control client access to a proxy server. Use this when a proxy configuration prevents the user from establishing a tunnel from outside the corporate network.

Native—Causes the client to use both proxy settings previously configured by AnyConnect, and the proxy settings configured in the browser.

The proxy settings configured in the global user preferences are pre-pended to the browser proxy settings. IgnoreProxy—Ignores the browser proxy settings on the user's computer. Override—Manually configures the address of the Public Proxy Server. Public proxy is the only type of proxy supported for Linux. Windows also supports public proxy. You can configure the public proxy address to be User Controllable. Uncheck this parameter if you want to disable support for local proxy connections.

Some examples of elements that provide a transparent proxy service include acceleration software provided by some wireless data cards, and network component on some antivirus software. Enable Optimal Gateway Selection OGS , IPv4 clients only — AnyConnect identifies and selects which secure gateway is best for connection or reconnection based on the round trip time RTT , minimizing latency for Internet traffic without user intervention.

OGS is not a security feature, and it performs no load balancing between secure gateway clusters or within clusters. You control the activation and deactivation of OGS and specify whether end users may control the feature themselves. Suspension Time Threshold hours — Enter the minimum time in hours that the VPN must have been suspended before invoking a new gateway-selection calculation. By optimizing this value in combination with the next configurable parameter Performance Improvement Threshold , you can find the correct balance between selecting the optimal gateway and reducing the number of times to force the re-entering of credentials.

Adjust these values for your particular network to find the correct balance between selecting the optimal gateway and reducing the number of times to force the re-entering of credentials.

When OGS is enabled, we recommend that you also make the feature user-controllable. If AAA is used, users may have to re-enter their credentials when transitioning to a different secure gateway.

Using certificates eliminates this problem. If disabled, VPN connections can only be started and stopped manually. Trusted Network Policy — Action AnyConnect automatically takes on the VPN connection when the user is inside the corporate network the trusted network. Connect—Initiates a VPN connection upon the detection of the trusted network. Do Nothing—Takes no action in the untrusted network.

Pause—AnyConnect suspends the VPN session instead of disconnecting it if a user enters a network configured as trusted after establishing a VPN session outside the trusted network.

When the user goes outside the trusted network again, AnyConnect resumes the session. This feature encourages greater security awareness by initiating a VPN connection when the user is outside the trusted network.

Do Nothing—Takes no action in the trusted network. If you are using NVM, Trusted DNS Domains and Servers are not supported because the the NVM module uses an administrator-defined trusted server and certificate hash to determine whether the user is on a trusted or untrusted network.

You must have a secure web server that is accessible with a trusted certificate to be considered trusted. Secure TND attempts a connection to the first configured server in the list. If the server cannot be contacted, secure TND attempts to contact the next server in the configured list.

If the server can be contacted but the hash of the certificate doesn't match, the network will be identified as "untrusted. If the hash is trusted, the "trusted" criteria is met. The Network Visibility Module sends flow information only when this feature is enabled so that data is sent over a secure TND connection. You can enforce corporate policies, protecting the computer from security threats by preventing access to Internet resources when it is not in a trusted network.

You can set the Always-On VPN parameter in group policies and dynamic access policies to override this setting by specifying exceptions according to the matching criteria used to assign the policy. If an AnyConnect policy enables Always-On and a dynamic access policy or group policy disables it, the client retains the disable setting for the current and future VPN sessions, as long as its criteria match the dynamic access policy or group policy on the establishment of each new session.

After enabling, you will be able to configure additional parameters. Users of Always-On VPN sessions may want to click Disconnect so they can choose an alternative secure gateway for reasons such as performance issues with the current VPN session or reconnection issues following the interruption of a VPN session. The Disconnect locks all interfaces to prevent data from leaking out and to protect the computer from internet access except for establishing a VPN session. For the reasons noted above, disabling the Disconnect button can at times hinder or prevent VPN access.

If you choose Always-On , the fail-open policy permits network connectivity, and the fail-close policy disables network connectivity.

Closed—Restricts network access when the VPN is unreachable. The purpose of this setting is to help protect corporate assets from network threats when resources in the private network responsible for protecting the endpoint are unavailable. Open—Permits network access when the VPN is unreachable. A connect failure closed policy prevents network access if AnyConnect fails to establish a VPN session.

It is primarily for exceptionally secure organizations where security persistence is a greater concern than always-available network access. It prevents all network access except for local resources such as printers and tethered devices permitted by split tunneling and limited by ACLs.

It can halt productivity if users require Internet access beyond the VPN if a secure gateway is unavailable. AnyConnect detects most captive portals. If it cannot detect a captive portal, a connect failure closed policy prevents all network connectivity. If you deploy a closed connection policy, we highly recommend that you follow a phased approach. For example, first deploy Always-On VPN with a connect failure open policy and survey users for the frequency with which AnyConnect does not connect seamlessly.

Then deploy a small pilot deployment of a connect failure closed policy among early-adopter users and solicit their feedback. Expand the pilot program gradually while continuing to solicit feedback before considering a full deployment. As you deploy a connect failure closed policy, be sure to educate the VPN users about the network access limitation as well as the advantages of a connect failure closed policy.

Related Topics: About Captive Portals. Allow Captive Portal Remediation —Lets AnyConnect lift the network access restrictions imposed by the closed connect failure policy when the client detects a captive portal hotspot. Hotels and airports typically use captive portals to require the user to open a browser and satisfy conditions required to permit Internet access.

By default, this parameter is unchecked to provide the greatest security; however, you must enable it if you want the client to connect to the VPN if a captive portal is preventing it from doing so. Remediation Timeout —Number of minutes AnyConnect lifts the network access restrictions. This parameter applies if the Allow Captive Portal Remediation parameter is checked and the client detects a captive portal. Specify enough time to meet typical captive portal requirements for example, 5 minutes.

Captive Portal Remediation Browser Failover —Allows the end user to use an external browser after closing the AnyConnect browser for captive portal remediation. If you uncheck this checkbox, the VPN connection choices are only those in the drop-down box, and users are restricted from entering a new VPN address. The client can exclude traffic destined for the secure gateway from the tunneled traffic intended for destinations beyond the secure gateway.

If you make this feature user controllable, users can read and change the PPP exclusion settings. Automatic—Enables PPP exclusion. Terminate Script On Next Event —Terminates a running script process if a transition to another scriptable event occurs.

On Microsoft Windows, the client also terminates any scripts that the OnConnect or OnDisconnect script launched, and all their script descendents. Authentication Timeout Values —By default, AnyConnect waits up to 12 seconds for an authentication from the secure gateway before terminating the connection attempt.

AnyConnect then displays a message indicating the authentication timed out. Enter a number of seconds in the range of 10 to You can configure a list of backup servers the client uses in case the user-selected server fails. If that fails, the client attempts each remaining server in the Optimal Gateway Selection list, ordered by its selection results. Those servers configured in the Server List take precedence, and backup servers listed here are overwritten. Add —Adds the host address to the backup server list.

Move Up —Moves the selected backup server higher in the list. If the user-selected server fails, the client attempts to connect to the backup server at the top of the list first, and moves down the list, if necessary.

Move Down —Moves the selected backup server down in the list. Delete —Removes the backup server from the server list. Enable the definition of various attributes that can be used to refine automatic client certificate selection on this pane.

If no certificate matching criteria is specified, AnyConnect applies the following certificate matching rules:.

If any criteria matching specifications are made in the profile, neither of these matching rules are applied unless they are specifically listed in the profile. Key Usage —Use the following Certificate Key attributes for choosing acceptable client certificates:.

The OIDs are included in parenthesis:. A certificate must match all of the specified key s you enter. Enter the key in the OID format for example, 1. The limit for the maximum characters for an OID is Distinguished Name Max 10 :—Specifies distinguished names DNs for exact match criteria in choosing acceptable client certificates.

Name —The distinguished name DN to use for matching:. Pattern —Specifies the string to match. The pattern to be matched should include only the portion of the string you want to match. There is no need to include pattern match or regular expression syntax. If entered, this syntax will be considered part of the string to search for.

For example, if a sample string was abc. Operator —The operator to use when performing matches for this DN. Wildcard —Enabled includes wildcard pattern matching. With wildcard enabled, the pattern can be anywhere in the string. Match Case —Check to enable case-sensitive pattern matching.

Certificate Expiration Threshold —The number of days before the certificate expiration date that AnyConnect warns users their certificate is going to expire not supported by RADIUS password-management. The default is zero no warning displayed. The range of values is zero to days. Certificate Import Store —Select which Windows certificate store to save enrollment certificates to.

For example, the hostname asa. When the user clicks Get Certificate , the client prompts the user for a username and one-time password. Thumbprint —The certificate thumbprint of the CA. Department OU —Department name specified in certificate. Company O —Company name specified in certificate. State ST —State identifier named in certificate.

Country C —Country identifier named in certificate. Email EA —Email address. Domain DC —Domain component. In the following example, Domain DC is set to cisco. Qualifier GEN —The generation qualifier of the user. Title T —The person's title. For example, Ms. Key size—The size of the RSA keys generated for the certificate to be enrolled. Use the VPN profile editor to enable the preference and configure global and per host certificate pins. You can only pin per host certificates in the server list section if the preference in the Global Pins section is enabled.

After enabling the preference, you can configure a list of global pins that the client uses for certificate pin verification. Adding per host pins in the server list section is similar to adding global pins. You can pin any certificates in the certificate chain, and they get imported to the profile editor to calculate the information required for pinning.

Add Pin —Initiates the Certificate Pinning Wizard which guides you through importing certificates into the Profile Editor and pinning them. The certificate details portion of the window allows you to visually verify the Subject and Issuer columns.

You can import any certificate of the server certificate chain into the profile editor to specify the information required for pinning. The profile editor supports three certificate import options:. AnyConnect version 3. You can configure a list of servers that appear in the client GUI.

Users can select servers in the list to establish a VPN connection. Delete —Removes the server from the server list. Use of the link-local secure gateway address is not supported. User Group —Specify a user group. If you specify the Primary Protocol as IPsec, the User Group must be the exact name of the connection profile tunnel group. For SSL, the user group is the group-url of the connection profile.

We recommend that you configure a list of backup servers the client uses in case the user-selected server fails. If the server fails, the client attempts to connect to the server at the top of the list first, and moves down the list, if necessary.

Conversely, the backup servers configured in AnyConnect Profile Editor, Backup Servers are global entries for all connection entries. Any entries put in Backup Servers of the Profile Editor are overwritten with what is entered here in Backup Server List for an individual server list entry. This setting takes precedence and is the recommended practice. If the client cannot connect to the host, it attempts to connect to the backup server. If the host for this server list entry is a load balancing cluster of security appliances, and the Always-On feature is enabled, specify the backup devices of the cluster in this list.

If you do not, Always-On blocks access to backup devices in the load balancing cluster. Add —Adds the address to the load balancing backup server list. Delete —Removes the load balancing backup server from the list. The default is SSL. IKE Identity —If you choose a standards-based EAP authentication method, you can enter a group or domain as the client identity in this field. When the user clicks Get Certificate, the client prompts the user for a username and one-time password.

Certificate Authentication —The Certificate Authentication policy attribute associated with a connection entry specifies how certificates are handled for this connection.

Valid values are:. Automatic —AnyConnect automatically chooses the client certificate with which to authenticate when making a connection. In this case, AnyConnect views all the installed certificates, disregards those certificates that are out of date, applies the certificate matching criteria defined in VPN client profile, and then authenticates using the certificate that matches the criteria. This happens every time the device user attempts to establish a VPN connection. Manual —AnyConnect searches for a certificate from the AnyConnect certificate store on the Android device when the profile is downloaded and does one of the following:.

If AnyConnect finds a certificate based on the certificate matching criteria defined in the VPN client profile, it assigns that certificate to the connection entry and uses that certificate when establishing a connection.

If a matching certificate cannot be found, the Certificate Authentication policy is set to Automatic. If the assigned certificate is removed from the AnyConnect certificate store for any reason, AnyConnect resets the Certificate Authentication policy to Automatic.

Disabled —A client certificate is not used for authentication. Make this Server List Entry active when profile is imported —Defines a server list entry as the default connection once the VPN profile has been downloaded to the device.

Only one server list entry can have this designation. The default value is disabled. This feature provides seamless mobility with a secure connection that persists across networks. It is useful for applications that require a connection to the enterprise, but consumes more battery life. If Network Roaming is disabled and AnyConnect loses a connection, it tries to re-establish a connection for up to 20 seconds if necessary. If it cannot, the device user or application must start a new VPN connection if one is necessary.

Network Roaming does not affect data roaming or the use of multiple mobile service providers. Connect on Demand requires certificate authorization —This field allows you to configure the Connect on Demand functionality provided by Apple iOS. You can create lists of rules that are checked whenever other applications start network connections that are resolved using the Domain Name System DNS.

Connect on Demand is an option only if the Certificate Authentication field is set to Manual or Automatic. If the Certificate Authentication field is set to Disabled, this check box is dimmed. The Connect on Demand rules, defined by the Match Domain or Host and the On Demand Action fields, can still be configured and saved when the check box is dimmed. Match Domain or Host —Enter the hostnames host. Do not enter IP addresses On Demand Action Specify one of the following actions when a device user attempts to connect to the domain or host defined in the previous step:.

Rules in this list take precedence over all other lists. When Connect On Demand is enabled, the application automatically adds the server address to this list. Remove this rule if you do not want this behavior.

Always Connect —Always connect behaviour is release dependent:. On iOS 7. Create a free Team What is Teams? Learn more. Location of Cisco VPN client profile configuration file. Asked 10 years, 9 months ago. Active 1 year, 11 months ago. Viewed 84k times. Improve this question. Peter Mortensen Is the old Mac using the Cisco provided client?

Google brought me here when searching for the location in Windows 7. Add a comment. Active Oldest Votes. Improve this answer. Asmus Asmus 2, 1 1 gold badge 12 12 silver badges 10 10 bronze badges. Not the answer see below with 39 up votes — Peter DeGregorio. Exactly where it was for me too, thx. Open a terminal and search for it go ahead to the next line if the previous one doesn't find anything : find. Sign up or log in Sign up using Google. Sign up using Facebook. Sign up using Email and Password.

Post as a guest Name. Email Required, but never shown.