Cisco ASA Series User Manual

1-17
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring AnyConnect VPN Client Connections
Configuring AnyConnect Connections
hostname(config)# group-policy sales attributes
hostname(config-group-policy)# webvpn
hostname(config-group-policy)# anyconnect-custom DeferredUpdateAllowed value true
Enabling Additional AnyConnect Client Features
To minimize download time, the client only requests downloads (from the ASA) of the core modules that
it needs. As additional features become available for the AnyConnect client, you need to update the
remote clients in order for them to use the features.
To enable new features, you must specify the new module names using the anyconnect modules
command from group policy webvpn or username webvpn configuration mode:
[no] anyconnect modules {none | value string}
Separate multiple strings with commas.
For a list of values to enter for each client feature, see the release notes for the
Cisco AnyConnect VPN Client.
Enabling Start Before Logon
Start Before Logon (SBL) allows login scripts, password caching, drive mapping, and more, for the
AnyConnect client installed on a Windows PC. For SBL, you must enable the ASA to download the
module which enables graphical identification and authentication (GINA) for the AnyConnect client.
The following procedure shows how to enable SBL:
Step 1 Enable the ASA to download the GINA module for VPN connection to specific groups or users using
the anyconnect modules vpngina command from group policy webvpn or username webvpn
configuration modes.
In the following example, the user enters group-policy attributes mode for the group policy
telecommuters, enters webvpn configuration mode for the group policy, and specifies the string vpngina:
hostname(config)# group-policy telecommuters attributes
hostname(config-group-policy)# webvpn
hostame(config-group-webvpn)#anyconnect modules value vpngina
Step 2 Retrieve a copy of the client profiles file (AnyConnectProfile.tmpl).
Step 3 Edit the profiles file to specify that SBL is enabled. The example below shows the relevant portion of
the profiles file (AnyConnectProfile.tmpl) for Windows:
<Configuration>
<ClientInitialization>
<UseStartBeforeLogon>false</UseStartBeforeLogon>
</ClientInitialization>
The <UseStartBeforeLogon> tag determines whether the client uses SBL. To turn SBL on, replace false
with true. The example below shows the tag with SBL turned on:
<ClientInitialization>
<UseStartBeforeLogon>true</UseStartBeforeLogon>
</ClientInitialization>
Step 4 Save the changes to AnyConnectProfile.tmpl and update the profile file for the group or user on the ASA
using the profile command from webvpn configuration mode. For example:

Cisco ASA Series Specifications

General

Brand	Cisco
Model	ASA Series
Category	Network Hardware
Language	English