The AnyConnect Profile Editor - Cisco

1 The AnyConnect Profile Editor Aboutthe ProfileEditor, page1 Stand-AloneProfileEditor, page2 The AnyConnectVPN Profile ,page4 The AnyConnectLocalPolicy, page20 About the Profile EditorThe CiscoAnyConnectSecureMobilityClientsoftw arepackagecontainsa profileeditorfor all profileeditorwhenyou load the AnyConnectclientimageon the uploada clientprofilefrom local or you load multipleAnyConnectpackages,ASDM activatesthe clientprofileeditorfrom the approachensuresthat the editordisplaysthe featuresfor the newestAnyConnectloaded,as well as the also a stand-aloneprofileeditorwhichruns on a New Profile from ASDMYou must first uploada clientimagebeforecreatinga deployedto administrator-definedend user requirementsand authenticationpolicieson endpointsas part of AnyConnect ,and they makethe preconfigurednetworkprofilesavailableto end theprofileeditorto createand configureone or profileeditoras part ofASDMand as a add a new clientprofileto the ASA from ASDM.

2 Cisco AnyConnect Mobile Platforms Administrator Guide, Release 1 ProcedureStep 1 OpenASDMand selectConfiguration>RemoteAccessVPN>Netw ork(Client) access >AnyConnectClient 3 Entera 4 Fromthe ProfileUsagedrop-downlist, choosethe modulefor whichyou are creatinga 5(Optional)In the ProfileLocationfield,clickBrowse Flashand selecta devicefile path for the XMLfile onthe 6(Optional)If you createda profilewith the stand-aloneeditor, clickUploadto use that 7(Optional)Choosean AnyConnectgrouppolicyfrom the Profile EditorIn additionto the profileeditorsin ASDM,you can use stand-aloneversionsof the profileeditorsfor client,you use the stand-aloneprofileeditorsto createprofilesfor the VPN serviceand othermodulesthat you deployto computersusingyour can modifythe stand-aloneCiscoAnyConnectProfileEditori nstallationor uninstallthe VPN or otherprofileeditorsusingAdd or Java A minimumof JRE is a prerequisitefor the profileeditor, but administratorsmust deployiton their is not uninstalledautomaticallywhenuninstalling the must uninstallit SupportedOperatingSystems This applicationhas been testedon Windows7.

3 The MSI only runs onWindows. SupportedBrowsers The help files in this applicationare supportedby Firefoxand not been testedin otherbrowsers. RequiredHard DriveSpace The CiscoAnyConnectProfileEditorapplicationr equiresless than fivemegabytesof hard requiresless than 100 megabytesof hard drivespace. You must includethe ASA in the VPN Profile s serverlist in orderfor the clientGUI to displayall usercontrollablesettingson the first you do not add the ASA addressor FQDNas a host entryin the Profile ,then filtersdo not applyfor the example,if you createa certificatematchandthe certificateproperlymatchesthe criteria,but you do not add the ASA as a host entryin that Profile ,the certificatematchis ignored.

4 Cisco AnyConnect Mobile Platforms Administrator Guide, Release AnyConnect Profile EditorStand-Alone Profile EditorInstall the Stand-Alone AnyConnect Profile EditorThe stand-aloneAnyConnectprofileeditoris distributedas a Windowsexecutablemsi file, separatelyfromthe AnyConnectISO and .pkg files, and has this file namingconvention: AnyConnect -profileedito r-win-<version> 1 Downloadtheanyconnect-profileeditor-win-<version> 2 Double-clickanyconnect-profileeditor-win -<version> launchthe 3At the Welcomescreen, 4At the ChooseSetupType window, click one of the followingbuttonsand clickNext: Typical Installsonly the NetworkAccessManagerprofileeditorautomat ically.

5 Custom Allowsyou to chooseany of the profileeditorsto install. Complete Automaticallyinstallsall of the 5If you clickedTypicalorCompletein the previousstep, skip to the next step. If you clickedCustomin thepreviousstep, click the icon for the stand-aloneprofileeditoryou want to installand selectWill be installedon local hard driveor click EntireFeaturewill be unavailableto preventthe 6At the Readyto Installscreen, 7 ClickFinish. The stand-aloneAnyConnectprofileeditoris installedin theC:\ProgramFiles\ Cisco \CiscoAnyConnect ProfileEditordirectory. You can launchthe profileeditorsby selectingStart>All Programs> Cisco > Cisco AnyConnectProfileEditorand then clickingthe stand-aloneprofileeditoryou want from the submenuor by clickingthe appropriateprofileeditorshortcuticon installedon the a Client Profile Using the Stand-Alone Profile EditorFor reasonsof security, you cannotmanuallyedit the clientprofileXMLfiles outsideof the stand-aloneprofileeditor.

6 Any profileXMLfile that is editedoutsidethe stand-aloneprofileeditorwill not be acceptedby AnyConnect Mobile Platforms Administrator Guide, Release 3 The AnyConnect Profile EditorInstall the Stand-Alone AnyConnect Profile EditorProcedureStep 1 Launchthe desiredprofileeditorby double-clickingthe shortcuticon on the desktopor by navigatingtoStart>AllPrograms> Cisco >Cisc oAnyConnectProfileEditorand selectingthe desiredprofileeditorfromthe 2 SelectFile>Openand navigateto the clientprofileXMLfile that you want to you mistakenlytry to open a clientprofileof one kind of feature,such as Web Security, usingthe profileeditorof anotherfeature,such as VPN,you receiveaSchemaValidationfailedmessageand you will notbe able to edit the you inadvertentlytry to edit the sameclientprofilein two instancesof the samekind of profileeditor, thelast edits madeto the clientprofileare 3 Makeyour changesto the profileand selectFile>Saveto save your AnyConnect VPN ProfileCiscoAnyConnectSecureMobilityClie ntfeaturesare enabledin the the core clientVPN functionalityand for the optionalclientmodulesNetworkAccessManage r, ISE posture,customerexperiencefeedback,and Web Security.

7 The ASA deploysthe profilesduringAnyConnectinstallationand can configurethe ASA or ISE to deployprofilesgloballyfor all AnyConnectusersor to usersbasedontheir grouppolicy. Usually, a user has a singleprofilefile for each somecases,you mightwant to providemorethan one VPN profilefor a user. Someonewho worksfrom multiplelocationsmightneed morethan one VPN storedlocallyon the user s computerin a user preferencesfile or a globalpreferencesfile. The user file has informationthe AnyConnectclientneedsto displayuser-controllablesettingsin thePreferencestab of the clientGUI and informationaboutthe last connection,such as the user, the group,andthe globalfile has informationaboutuser-controllablesetting sso that you can applythosesettingsbeforelogin (sincethere is no user).

8 For example,the clientneedsto knowif Start BeforeLogonand/orAutoConnectOn Start are Profile Editor , Preferences (Part 1) Use Start Before Logon (WindowsOnly)Forcesthe user to connectto the enterpriseinfrastructureover a VPN connectionbeforeloggingon to Windowsby startingAnyConnectbeforethe Windowslogin dialogbox ,the login dialogbox appearsand the user logs in as usual. Show Pre-connectMessage Enablesan administratorto have a one-timemessagedisplayedprior toa usersfirst example,the messagecan remindusersto inserttheir smartcardinto its reader. The messageappearsin the AnyConnectmessagecatalogand is localized. Cisco AnyConnect Mobile Platforms Administrator Guide, Release AnyConnect Profile EditorThe AnyConnect VPN Profile CertificateStore Controlswhichcertificatestore(s)AnyConne ctuses for storingand defaultsetting(All) is appropriatefor most not changethis settingunlessyouhave a specificreasonor scenariorequirementto do so.

9 All (Default)Directsthe AnyConnectclientto use all certificatestoresfor locatingcertificates. Machine Directsthe AnyConnectclientto restrictcertificatelookupto the Windowslocal machinecertificatestore. User Directsthe AnyConnectclientto restrictcertificatelookupto the local user certificatestores. CertificateStore Override Allowsan administratorto directAnyConnectto searchfor certificatesin the Windowsmachinecertificatestore whenthe usersdo not have administratorprivilegeson must have a pre-deployedprofilewith this optionenabledin orderto connectwithWindowsusinga this profiledoes not exist on a Windowsdeviceprior to connection,the certificateis not accessiblein the machinestore,and AutoConnectonStart AnyConnect ,whenstarted,automaticallyesta blishesa VPN connectionwiththe securegatewayspecifiedby the AnyConnectprofile,or to the last gatewayto whichthe clientconnected.

10 MinimizeOn Connect Afterestablishinga VPN connection,the AnyConnectGUI minimizes. LocalLANA ccess Allowsthe user completeaccessto the local LAN connectedto the remotecomputerduringthe VPN sessionto the LANaccesscan potentiallycreatea securityweaknessfrom the publicnetworkthroughthe user computerinto the , you canconfigurethe securityappliance( (1)or later)to deployan SSL clientfirewallthat uses the AnyConnectClientLocalPrint firewallrule includedin the defaultgrouppolicy. In orderto enablethis firewallrule, you also must enableAutomaticVPN Policy,Alwayson, and AllowVPN Disconnectin this Editor , Preferences(Part 2).Note Auto Reconnect AnyConnectattemptsto reestablisha VPN connectionif you lose connectivity.