Cisco Cisco ASA 5555-X Adaptive Security Appliance 發佈版本通知

Mobile Posture

(formerly referred to as 
AnyConnect 
Identification 
Extensions for Mobile 
Device Detection)

You can now configure the ASA to permit or deny VPN connections to mobile devices, enable or 
disable mobile device access on a per-group basis, and gather information about connected mobile 
devices based on the mobile device posture data. The following mobile platforms support this 
capability: AnyConnect for iPhone/iPad/iPod Versions 2.5.x and AnyConnect for Android Version 
2.4.x. You do not need to enable CSD to configure these attributes in ASDM.

Enforcing remote access controls and gathering posture data from mobile devices requires an 
AnyConnect Mobile license and either an AnyConnect Essentials or AnyConnect Premium license 
to be installed on the ASA. You receive the following functionality based on the license you install:

Enterprises that install the AnyConnect Premium license will be able to enforce DAP policies, 
on supported mobile devices, based on these DAP attributes and any other existing endpoint 
attributes. This includes allowing or denying remote access from a mobile device.

Enterprises that install the AnyConnect Essentials license will be able to do the following: 

Enable or disable mobile device access on a per-group basis and to configure that feature 
using ASDM.

Display information about connected mobile devices via CLI or ASDM without having the 
ability to enforce DAP policies or deny or allow remote access to those mobile devices. 

We modified the following screen: Configuration > Remote Access VPN > Network (Client) 
Access > Dynamic Access Policies > Add/Edit Endpoint Attributes > Endpoint Attribute 
Type:AnyConnect.

Split Tunnel DNS policy 
for AnyConnect

This release includes a new policy pushed down to the AnyConnect Secure Mobility Client for 
resolving DNS addresses over split tunnels. This policy applies to VPN connections using the SSL 
or IPsec/IKEv2 protocol and instructs the AnyConnect client to resolve all DNS addresses through 
the VPN tunnel. If DNS resolution fails, the address remains unresolved and the AnyConnect client 
does not try to resolve the address through public DNS servers.

By default, this feature is disabled. The client sends DNS queries over the tunnel according to the 
split tunnel policy—tunnel all networks, tunnel networks specified in a network list, or exclude 
networks specified in a network list.

We modified the following screen: Configuration > Remote Access VPN > Network (Client) 
Access > Group Policies > Add/Edit Group Policy > Advanced > Split Tunneling (see the Send All 
DNS Lookups Through Tunnel check box).