AnyConnect 3.0.4235 is a maintenance release that resolves the list of caveats and adds support for Mac OS X, ScanCenter server to host and distribute Web Security client profiles, enhanced split DNS functionality, and LZS compression.
Mac OS X Support
The Web Security Module now supports these Mac OS X operating systems:
•Mac OS X v10.7 (x86 32-bit and x64 64-bit)
•Mac OS X v10.6 (x86 32-bit and x64 64-bit)
•Mac OS X v10.5 (x86 32-bit)
New Installation Directory Structure for Mac OS X
In previous releases of AnyConnect, AnyConnect components were installed in the opt/cisco/vpn path. Now, AnyConnect components are installed in the /opt/cisco/anyconnect path.
ScanCenter Hosted Configuration Support for Web Security Client Profile
The ScanCenter Hosted Configuration for the Web Security Hosted Client Profile gives administrators the ability to provide new Web Security client profiles to Web Security clients. Devices with Web Security can download a new client profile from the cloud (hosted configuration files reside on the ScanCenter server). The only prerequisite for this feature is for the device to have Web Security installed with a valid client profile.
Administrators use the Web Security Profile Editor to create the client profile files and then upload the clear text XML file to a ScanCenter server. This XML file must contain a valid license key from ScanSafe. The Hosted Configuration feature uses the license key when retrieving a new client profile file from the Hosted Configuration (ScanCenter) server. Once the new client profile file is on the server, devices with Web Security automatically poll the server and download the new client profile file, provided that the license in the existing Web Security client profile is the same as a license associated with a client profile on the Hosted server. Once a new client profile has been downloaded, Web Security will not download the same file again until the administrator makes a new client profile file available.
Web Security client devices must be pre-installed with a valid client profile file containing a ScanSafe license key before it can use the Hosted Configuration feature.
Split DNS Functionality Enhancement
AnyConnect 3.0.4235 supports true split DNS functionality for Windows platforms, just as found in legacy IPsec clients. If the group policy on the security appliance enables split-include tunneling and if it specifies the DNS names to be tunneled, AnyConnect tunnels any DNS queries that match those names to the private DNS server. True split DNS allows tunnel access to only DNS requests that match the domains pushed down by the ASA. These requests are not sent in the clear. On the other hand, if the DNS requests do not match the domains pushed down by the ASA, AnyConnect lets the DNS resolver on the client operating system submit the host name in the clear for DNS resolution.
AnyConnect tunnels all DNS queries if the group policy does not specify any domains to be tunneled or if Tunnel All Networks is chosen at Configuration > Remote Access VPN > Network (Client) Access > Group Policies > Add or Edit > Advanced > Split Tunneling.
This 3.0.4235 feature requires that you:
•configure at least one DNS server
•enable split-include tunneling
•specify at least one domain to be tunneled
To configure this feature, establish an ASDM connection to the security appliance and configure the following:
•Split-include tunneling—Choose Configuration > Remote AccessVPN > Network (Client) Access > Group Policies > Add or Edit > Advanced > Split Tunneling. From the Policy drop-down menu, choose Tunnel List Below and select the relevant network list from the Network List drop-down menu.
•DNS Servers—Choose Configuration > Remote AccessVPN > Network (Client) Access > Group Policies > Add or Edit > Servers. Enter one or more private DNS servers in the DNS Servers field.