Chapter 1. AnyConnect for Windows Phone Release Notes

AnyConnect for Windows 10 Mobile and Windows Phone 8.1 Devices

AnyConnect Mobile Related Documentation

Windows Phone Supported Devices

New Features in AnyConnect 4.1.03024 for Windows 10 Mobile Devices

New Features in AnyConnect 4.1.03017 for Windows 10 Mobile Devices

Windows 10 Mobile and Phone 8.1 AnyConnect Feature Matrix

Adaptive Security Appliance Requirements

Guidelines and Limitations for AnyConnect on Windows 10 and Windows Phone 8.1

Known Compatibility Issues with AnyConnect on Windows 10 Mobile & Phone 8.1

Open and Resolved AnyConnect Issues

Open Issues in AnyConnect 4.1.03024 for Windows 10 Mobile

Resolved Issues in AnyConnect 4.1.03024 for Windows Phone

Chapter 1. AnyConnect for Windows Phone Release Notes

AnyConnect for Windows 10 Mobile and Windows Phone 8.1 Devices

The AnyConnect Secure Mobility Client provides remote users with secure VPN connections to the Cisco ASA 5500 Series. It provides seamless and secure remote access to enterprise networks allowing installed applications to communicate as though connected directly to the enterprise network. AnyConnect supports connections to IPv4 and IPv6 resources over an IPv4 or IPv6 tunnel.

This document, written for system administrators of the AnyConnect Secure Mobility Client and the Adaptive Security Appliance (ASA) 5500, supplements the Cisco AnyConnect Secure Mobility Client Administrator Guide, Release 4.1 and provides release specific information for AnyConnect running on Windows Phone devices.

The AnyConnect app is available on the Windows Store only. Cisco does not distribute AnyConnect mobile apps. Nor can you deploy the mobile app from the ASA. You can deploy other releases of AnyConnect for desktop devices from the ASA while supporting this mobile release.

AnyConnect Mobile Support Policy

Cisco supports the AnyConnect version that is currently available in the app store; however, fixes and enhancements are provided only in the most recently released version.

AnyConnect Licensing

To connect to the ASA headend an AnyConnect 4.x Plus or Apex license is required, trial licenses are available, see the Cisco AnyConnect Ordering Guide.

For the latest end-user license agreement, see Cisco End User License Agreement, AnyConnect Secure Mobility Client, Release 4.x.

For our open source licensing acknowledgments, see Open Source Software Used In Cisco AnyConnect Secure Mobility Client Release 4.0 for Mobile

AnyConnect Mobile Related Documentation

For more information refer to the following documentation:

- AnyConnect Release Notes

- AnyConnect Administrator Guides

- Navigating the Cisco ASA Series Documentation

Windows Phone Supported Devices

Windows 10 Mobile Support

AnyConnect on Windows Mobile or Windows Phone is supported on mobile devices that run Microsoft Windows 10 Mobile.

Windows 10 Mobile is not intended for non-mobile Windows 10 devices. Cisco has a fully featured version of AnyConnect available for non-mobile devices, which is not distributed in the Windows store.

Windows Phone 8.1 Support

Note

“Effective December 31 2017, Cisco will no longer provide AnyConnect for Windows Phone 8.1 for new downloads in the Windows App Store. Microsoft has previously announced End of Support for this operating system Click Here .

Till December 31, 2017 AnyConnect is also supported on mobile devices that run Microsoft Windows Phone 8.1 Update which includes the following versions: 8.10.14141.167, 8.10.14147.180, 8.10.14157.200, 8.10.14176.243, 8.10.14192.280, 8.10.14203.206, 8.10.14219.341, or 8.10.14226.359. The OS on the phone must be one of the listed versions in order for AnyConnect to work properly.

Users can verify their OS version at Settings > About > More Information on their device. For more OS version information see Microsoft's Windows Phone 8.1 update history.

Note

Earlier versions of Windows Phone 8.1 will allow AnyConnect installation, but it will not operate or be available to configure under Settings > VPN > AddProfile > Type.

See Windows Phone User Guide for Cisco AnyConnect Secure Mobility Client, Release 4.1.x for installation and upgrade procedures.

New Features in AnyConnect 4.1.03024 for Windows 10 Mobile Devices

AnyConnect 4.1.03024 is a release candidate for Cisco AnyConnect Secure Mobility Client on Windows Phone mobile devices. It includes these Resolved Issues in AnyConnect 4.1.03024 for Windows Phone.

Cisco recommends that you review the Guidelines and Limitations for AnyConnect on Windows 10 and Windows Phone 8.1 to be aware of current operational considerations.

See the Windows 10 Mobile and Phone 8.1 AnyConnect Feature Matrix for a list of supported features in this app.

New Features in AnyConnect 4.1.03017 for Windows 10 Mobile Devices

AnyConnect 4.1.03017 is a release candidate of Cisco AnyConnect Secure Mobility Client on Windows Phone mobile devices. See the Windows 10 Mobile and Phone 8.1 AnyConnect Feature Matrix for a list of supported features in this app.

Cisco recommends that you review the Guidelines and Limitations for AnyConnect on Windows 10 and Windows Phone 8.1 to be aware of current operational considerations.

Windows 10 Mobile and Phone 8.1 AnyConnect Feature Matrix

The following remote access features are supported by Cisco AnyConnect on Windows Phone:

Category: Feature

Windows Phone

Deployment and Configuration:

Install or upgrade from Application Store

Yes

Cisco VPN Profile support (manual import)

No

Cisco VPN Profile support (import on connect)

No

MDM configured connection entries

Yes

User-configured connection entries

Yes

Tunneling:

TLS

Yes

Datagram TLS (DTLS)

No

IPsec IKEv2 NAT-T

No

IKEv2 - raw ESP

No

Suite B (IPsec only)

No

TLS compression

No

Dead peer detection

No

Tunnel keepalive

No

Multiple active network interfaces

No

Per App Tunneling (requires Plus or Apex license and ASA 9.4.2 or later)

No

Full tunnel (OS may make exceptions on some traffic, such as traffic to the app store)

Yes

Split tunnel (split include)

Yes

Local LAN (split exclude)

No, defect in Windows Phone 8.1.

Split-DNS

Yes

Auto Reconnect / Network Roaming

Yes, if user remains on the same network and the network connection has not terminated.

VPN on-demand (triggered by destination)

Yes

VPN on-demand (triggered by application)

No

Rekey

Yes, initiated by gateway only.

IPv4 public transport

Yes

IPv6 public transport

Yes

IPv4 over IPv4 tunnel

Yes

IPv6 over IPv4 tunnel

Yes

Default domain

Yes

DNS server configuration

Yes

Private-side proxy support

Yes, limited support in Windows Phone 8.1.

Proxy Exceptions

No

Public-side proxy support

No

Pre-login banner

Yes

Post-login banner

Yes

DSCP Preservation

No

Connecting and Disconnecting:

VPN load balancing

Yes

Backup server list

No

Optimal Gateway Selection

No

Authentication:

SAML 2.0

No

Client Certificate Authentication

Yes

Online Certificate Status Protocol (OCSP)

No

Manual user certificate management

Yes, using Windows Phone capabilities.

Manual server certificate management

Yes

SCEP legacy enrollment Please confirm for your platform.

No

SCEP proxy enrollment Please confirm for your platform.

No

Automatic certificate selection

Yes

Manual certificate selection

No

Smart card support

No

Username and password

Yes

Tokens/challenge

Yes

Double authentication

Yes

Group URL (specified in server address)

Yes

Group selection (drop-down selection)

Yes

Credential prefill from user certificate

Yes

Save password

No

User interface:

Standalone GUI

Yes, limited functions.

Native OS GUI

Yes

API / URI Handler (see below)

No

UI customization

No

UI localization

No

User preferences

Partial

Home screen widgets for one-click VPN access

No

AnyConnect specific status icon

No

Mobile Posture: (AnyConnect Identity Extensions, ACIDex)

Serial number or unique ID check

No

OS and AnyConnect version shared with headend

Yes

URI Handling:

Add connection entry

No

Connect to a VPN

No

Credential pre-fill on connect

No

Disconnect VPN

No

Import certificate

No

Import localization data

No

Import XML client profile

No

External (user) control of URI commands

No

Reporting and Troubleshooting:

Statistics

No

Logging / Diagnostic Information (DART)

Yes, Field Medic app required.

Certifications:

FIPS 140-2 Level 1

No

Adaptive Security Appliance Requirements

A minimum release of the ASA is required for the following features:

Note

Refer to the feature matrix for your platform to verify the availability of these features in the current AnyConnect mobile release.

- You must upgrade to ASA 9.3.2 or later to use TLS 1.2.

- You must upgrade to ASA 9.0 to use the following mobile features:

- IPsec IKEv2 VPN

- Suite B cryptography

- SCEP Proxy

- Mobile Posture

- ASA Release 8.0(3) and Adaptive Security Device Manager (ASDM) 6.1(3) are the minimum releases that support AnyConnect for mobile devices.

Guidelines and Limitations for AnyConnect on Windows 10 and Windows Phone 8.1

- Performance is limited due to non-support of DTLS and IPsec/IKEv2.

- VPN roaming (transitioning between WiFi and 3/4G networks) is not supported.

- AnyConnect does not receive or process the AnyConnect VPN Profile from the Secure Gateway.

- A user initiated disconnect does not cleanly disconnect from the head end. Cisco recommends you connect to ASA VPN groups with a small idle timeout to clear orphaned sessions on the ASA.

- When the mobile device user is connecting to an ASA that does not have a valid mobile license, the user will get into a login loop, where after entering credentials the authentication will restart and eventually (after 5 attempts) send the user a generic error message: The VPN connection has failed with error code 602. Please contact your administrator and ensure that a valid mobile license is installed on the secure gateway

Known Compatibility Issues with AnyConnect on Windows 10 Mobile & Phone 8.1

- Due to the implementation of some Windows apps, they are not supported when a VPN is connected.

The following Windows native apps have been tested and do not work: MSN Money, MSN Food and Drink, Health & Fitness, MSN News, Weather, MSN Sports. The following apps have been tested and operate successfully: xbox Music, xbox Games, xbox video, Podcasts

- Due to an OS defect in Windows Phone 8.1 and Windows Phone 10, certain scenarios (intermittently seen during roaming/reconnects) will result in the inability to pass traffic.

After hitting this scenario, subsequent connection attempts will result in a 602 Error. You must reboot your device to work around this issue. We expect Microsoft to resolve this defect in Windows 10 Mobile and will work with Microsoft to expedite resolution.

- Windows Phone 8.1 does not support automatic VPN reconnects if radio coverage is interrupted.

Specifically, automatic VPN reconnects are not supported when the phone switches from WiFi to cellular network (or vice versa) or when roaming from one WiFi network to another. Windows Phone 8.1 will attempt to automatically reconnect the VPN if radio coverage is maintained and connectivity to the VPN gateway is lost due to a temporary network disruption. In this case the operating system will attempt to reconnect the VPN when there is data to send through the tunnel. The operating system will try to reconnect the VPN either ten times, or for one minute, whichever happens first. After ten attempts or one minute the operating system will disconnect the VPN fully and user intervention will be required to reconnect.

- Windows Phone 8.1 OS imposes the following policies regarding split tunnel VPN:

Both IPv4 and IPv6 split tunneling is supported, but if either IPv4 or IPv6 is set to tunnel all traffic then any split tunnel rules for the other address family are ignored and all IPv4 and IPv6 traffic will be tunneled.

In order to access hosts on the network when split tunnel VPN is configured, either split DNS or a default domain name must also be specified in the group policy configuration sent from the VPN gateway. Otherwise some hosts will be inaccessible.

- Hostnames for which DNS resolution happens in the tunnel must resolve to addresses which fall in the split tunnel routes.

- Hostnames for which DNS resolution happens outside the tunnel must resolve to addresses which fall outside the split tunnel routes.

- Windows Phone 8.1 OS supports limited proxy configuration with the following considerations:

Windows Phone 8.1 OS does not support proxies on any port other than TCP 80. When the VPN server configuration includes a proxy server with a port number, AnyConnect strips the port number prior to applying the configuration to the VPN channel.

Furthermore, the Windows Phone 8.1 OS does not allow proxy exceptions to be applied to the VPN connection. Any proxy exceptions configured on the VPN server and delivered to AnyConnect will be silently ignored.

- The automatic connection feature in the VPN Profile requires additional on-demand VPN configuration be done before you can save a profile. Without the additional on-demand configuration in place, you must turn the Connect automatically feature Off to Save the profile.

- There is a known issue with certificate usage identification on Windows Phone OS version "8.10.14157.200" or earlier. Verify your OS version in Settings > About. To avoid this issue upgrade your Windows Phone if one is available in Settings > Phone Update.

Open and Resolved AnyConnect Issues

The Cisco Bug Search Tool, Click Here , has detailed information about the following open and resolved issues in this release. A Cisco account is required to access the Bug Search Tool. If you do not have one, register at Click Here .

Open Issues in AnyConnect 4.1.03024 for Windows 10 Mobile

Identifier

Headline

CSCuv32132

[Windows Phone] Client needs to handle DPD settings from asa properly

CSCuv68051

[Windows Phone] Reconnect Issue

Resolved Issues in AnyConnect 4.1.03024 for Windows Phone

Identifier

Headline

CSCvc11637

[Windows 10 Mobile] not sync connection status between headend and anyconnect on windows phone

Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: Click Here . Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)