CISCO Secure Client Including Any Connect

Product Information

Specifications

• Product Name: Cisco Secure Client
• Release Version: 5.x
• First Published: 2025-03-31

Cisco Secure Client (including AnyConnect) Features, License, and OSs, Release 5.x
This document identifies the Cisco Secure Client release 5.1 features, license requirements, and endpoint operating systems that are supported in the Secure Client (including AnyConnect). It also includes supported crytographic algorithms and accessibility recommendations.

Supported Operating Systems

Cisco Secure Client 5.1 supports the following operating systems.

Windows

• Windows 11 (64-bit)
• Microsoft-supported versions of Windows 11 for ARM64-based PCs (Supported only in VPN client, DART, Secure Firewall Posture, Network Visibility Module, Umbrella Module, ISE Posture, and Zero Trust Access Module)
• Windows 10 x86(32-bit) and x64 (64-bit)

macOS (64-bit only)

• macOS 15 Sequoia
• macOS 14 Sonoma
• macOS 13 Ventura

Linux

• Red Hat: 9.x and 8.x (except ISE Posture Module, which only supports 8.1 (and later)
• Ubuntu: 24.04, 22.04, and 20.04
• SUSE (SLES)
  • VPN: Limited support. Used only to install ISE Posture.
  • Not supported for Secure Firewall Posture or Network Visibility Module.
  • ISE Posture: 12.3 (and later) and 15.0 (and later)
• See the Release Notes for Cisco Secure Client for OS requirements and support notes. See the Offer Descriptions and Supplemental Terms for licensing terms and conditions, and a breakdown of orderability and the specific terms and conditions of the various licenses.
• See the Feature Matrix below for license information and operating system limitations that apply to Cisco Secure Client modules and features.

Supported Cryptographic Algorithms

The following table lists the cryptographic algorithms supported by Cisco Secure Client. The cryptographic algorithms and cipher suites are shown in the order of preference, most to least. This preference order is dictated by Cisco’s Product Security Baseline to which all Cisco products must comply. Note that the PSB requirements change from time to time so the cryptographical algorithms supported by subsequent versions of Secure Client will change accordingly.

TLS 1.3, 1.2, and DTLS 1.2 Cipher Suites (VPN)

TLS 1.2 Cipher Suites (Network Access Manager)

DTLS 1.0 Cipher Suites (VPN)

IKEv2/IPsec Algorithms

Encryption

• ENCR_AES_GCM_256
• ENCR_AES_GCM_192
• ENCR_AES_GCM_128
• ENCR_AES_CBC_256
• ENCR_AES_CBC_192
• ENCR_AES_CBC_128

Pseudo Random Function

• PRF_HMAC_SHA2_256
• PRF_HMAC_SHA2_384
• PRF_HMAC_SHA2_512
• PRF_HMAC_SHA1

Diffie-Hellman Groups

• DH_GROUP_256_ECP – Group 19
• DH_GROUP_384_ECP – Group 20
• DH_GROUP_521_ECP – Group 21
• DH_GROUP_3072_MODP – Group 15
• DH_GROUP_4096_MODP – Group 16

Integrity

• AUTH_HMAC_SHA2_256_128
• AUTH_HMAC_SHA2_384_192
• AUTH_HMAC_SHA1_96
• AUTH_HMAC_SHA2_512_256

License Options

• Use of the Cisco Secure Client 5.1 requires that you purchase either a Premier or Advantage license. The license(s) required depends on the Secure Client features that you plan to use, and the number of sessions that you want to support. These user-based licenses include access to support, and software updates that align with general BYOD trends.
• Secure Client 5.1 licenses are used with Cisco Secure Firewall Adaptive Security Appliances (ASA), Integrated Services Routers (ISR), Cloud Services Routers (CSR), and Aggregated Services Routers (ASR), as well as other non-VPN headend such as Identity Services Engine (ISE). A consistent model is used regardless of the headend, so there is no impact when headend migrations occur.

One or more of the following Cisco Secure licenses may be required for your deployment:

Advantage and Premier License

• From the Cisco Commerce Workspace website, choose the service tier (Advantage or Premier) and the length of term (1, 3, or 5 year). The number of licenses that are needed is based on the number of unique or authorized users that will make use of Secure Client. Secure Client is not licensed based on simultaneous connections. You can mix Advantage and Premier licenses in the same environment, and only one license is required for each user.
• Cisco Secure 5.1 licensed customers are also entitled to earlier AnyConnect releases.

Feature Matrix

Cisco Secure 5.1 modules and features, with their minimum release requirements, license requirements, and supported operating systems are listed in the following sections:

Cisco Secure Client Deployment and Configuration

* Ability to minimize Secure Client on VPN connect, or block connections to untrusted servers

AnyConnect VPN Core Features

Connect and Disconnect Features

Authentication and Encryption Features

Interfaces

Secure Firewall Posture (Formerly HostScan) and Posture Assessment

ISE Posture

Network Access Manager

*If you are using ISE as a RADIUS server, note the following guidelines.

• ISE started support for TLS 1.2 in release 2.0. Network Access Manager and ISE will negotiate to TLS 1.0 if you have Cisco Secure Client with TLS 1.2 and an ISE release prior to 2.0. Therefore, if you use Network Access Manager and EAP-FAST  with ISE 2.0 (or later) for RADIUS servers, you must upgrade to the appropriate release of ISE as well.
• Incompatibility warning: If you are an ISE customer running 2.0 or higher, you must read this before proceeding!
• The ISE RADIUS has supported TLS 1.2 since release 2.0, however there is a defect in the ISE implementation of EAP-FAST using TLS 1.2 tracked by CSCvm03681. The defect has been fixed in the 2.4p5 release of ISE.
• If NAM is used to authenticate using EAP-FAST with any ISE releases that support TLS 1.2 prior to the above releases, the authentication will fail and the endpoint will not have access to the network.

AMP Enabler

Network Visibility Module

Secure Umbrella Module

For information on Umbrella licensing, see https://www.opendns.com/enterprise-security/threat-enforcement/packages/

Thousand Eyes Endpoint Agent Module

Customer Experience Feedback

Diagnostic and Report Tool (DART)

Accessibility Recommendations
We are committed to enhancing accessibility and to providing a seamless experience for all users, by adhering to specific Voluntary Product Accessibility Template (VPAT) compliance standards. Our product is designed to integrate effectively with various accessibility tools, ensuring it is both user-friendly and accessible to individuals with specific needs.

JAWS Screen Reader
For Windows users, we recommend using the JAWS screen reader and its capabilities to assist those with disabilities. JAWS (Job Access with Speech) is a powerful screen reader that provides audio feedback and keyboard shortcuts for users with visual impairments. It allows users to navigate through applications and websites using speech output and braille displays. By integrating with JAWS, our product ensures that visually impaired users can efficiently access and interact with all features, enhancing their overall productivity and user experience.

Windows Operating System Accessibility Tools

Windows Magnifier
The Windows Magnifier tool allows users to enlarge on-screen content, improving visibility for those with low vision. Users can zoom in and out easily, ensuring that text and images are clear and readable.
On Windows, set your display resolution to at least 1280px x 1024px. You can zoom to 400% by changing the Scaling on Display setting and view one or two module tiles in Secure Client. To zoom in above 200%, the Secure Client Advanced Window contents may not be fully available (depending on your monitor size). We do not support Reflow, which is typically used on content-based web pages and publications and also known as Responsive Web Design.

Invert Colors
The invert colors feature provides contrast themes (aquatic, dusk, and night sky) and Windows custom themes. The user needs to change Contrast Theme in the Windows setting to apply high contrast mode to Secure Client and make it easier for those with certain visual impairments to read and interact with on-screen elements.

Keyboard Navigation Shortcuts
Because Secure Client is not a content-based web application, it has its own controls and graphics within its UI. For efficient navigation, Cisco Secure Client supports various keyboard shortcuts. By following the below recommendations and using the described tools and shortcuts, users can enhance their interaction with Secure Client, ensuring a more accessible and efficient experience:

• Tab Navigation: Use the Tab key for individual panel navigation through the primary (tile) window, DART setup dialogs, and each module’s sub dialogs. The Spacebar or Enter trigger the action. An item in focus is indicated as dark blue, and the indication of a shift in focus is portrayed with a frame around the control.
• Module Selection: Use the Up/Down arrow keys to navigate through specific modules on the left navigation bar.
• Module Property Pages: Use the Left/Right arrow keys to navigate between individual settings tabs, and then use the Tab key for panel navigation.
• Advanced Window: Use the Alt+Tab to choose it and Esc to close it.
• Navigation of Group Table List: Use PgUp/PgDn or Spacebar/Enter to expand or collapse a specific group.
• Minimize/Maximize the active Secure Client UI: Windows Logo key + Up/Down arrow.
• About Dialog: Use the Tab key to navigate through this page, and use the Spacebar to launch any available hyperlinks.

Frequently Asked Questions

• Q: What operating systems are supported by Cisco Secure Client?
  • A: Cisco Secure Client 5.1 supports Windows operating systems.
• Q: How can I access licensing terms and conditions for Cisco Secure Client?
  • A: Refer to the Offer Descriptions and Supplemental Terms provided in the documentation for detailed licensing information.
• Q: What cryptographic algorithms are supported by Cisco Secure Client?
  • A: The supported cryptographic algorithms include TLS 1.3, 1.2,and DTLS 1.2 Cipher Suites as well as TLS 1.2 Cipher Suites for Network Access Manager.

Documents / Resources

CISCO Secure Client Including Any Connect [pdf] User Guide Release 5.1, Secure Client Including Any Connect, Client Including Any Connect, Including Any Connect, Any Connect

References

• User Manual