11

I'm using Cisco AnyConnect 3.1.04059 (on a Windows 7 - I'm an admin) to connect to work's VPN. I have located the profile that is stored locally that's being used by the client. But when I make modifications to it (like disabling it from starting before logging in), those modifications get overwritten right after a connection is established. How can I prevent that from happening?

Improve this question
1

1 Answer 1

Reset to default
13

The fields within the locally stored AnyConnect profile .xml do not reflect local changes made to user controllable preferences.

Cisco AnyConnect profile:

When an endpoint connects to an ASA using the Cisco AnyConnect Secure Mobility Client, the profile that is stored locally is either merged with updates made to the ASA, or a new file is added if the .xml file is missing/removed. The settings within this .xml are not designed to be locally editable and will be overwritten, with the profile that is configured on the ASA, upon successfully connecting. The location of the AnyConnect profile varies by OS, but the location for Windows 7 is:

%ProgramData%\Cisco\Cisco AnyConnect Secure Mobility Client\Profile\name.xml

Cisco AnyConnect preferences:

However, there are user editable preferences that can be modified within the Cisco AnyConnect Secure Mobility Client's UI. The changes made in the UI are stored in a separate .xml file. The location of the user editable preference file varies by OS, but the location for Windows 7 is:

C:\Users\username\AppData\Local\Cisco\Cisco AnyConnect Secure Mobility Client\preferences.xml

enter image description here

Reference: AnyConnect 3.0 Administration Guide

Improve this answer
2
  • 1
    I was able to locate that preference file, then I enabled Local Lan Access. The preference showed up fine before connecting to work, but then, after the connection, that checkbox disappeared. And to test that setting, I tried pining my local desktop PC and I wasn't able to. Is there a way to enable local access from the client?
    – Kingamoon
    Sep 1, 2013 at 3:33
  • 1
    The Allow local (LAN) access when using VPN (if configured) is a setting that is contingent upon the configuration of the ASA. The client firewall rules that are pushed down to the client are specified on the ASA and may not allow local communication even if this box is ticked. If the firewall rules pushed to the endpoint are restrictive a local administrator can potentially bypass them, though I have not tested that particular scenario. Reference document.
    – one.time
    Sep 1, 2013 at 6:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .