Cisco ASA 5505 - Manual (Page 1412)

66-4
Cisco ASA 5500 Series Configuration Guide using the CLI
Chapter 66 Setting General VPN Parameters
Using Client Update to Ensure Acceptable IPsec Client Revision Levels
The following example shows how to set a maximum Anyconnect VPN session limit of 450:
hostname(config)# vpn-sessiondb max-anyconnect-premium-or-essentials-limit 450
hostname(config)#
Using Client Update to Ensure Acceptable IPsec Client Revision
Levels
Note The information in this section applies to IPsec connections only.
The client update feature lets administrators at a central location automatically notify VPN client users
that it is time to update the VPN client software and the VPN 3002 hardware client image.
Remote users might be using outdated VPN software or hardware client versions. You can use the
client-update command at any time to enable updating client revisions; specify the types and revision
numbers of clients to which the update applies; provide a URL or IP address from which to get the
update; and, in the case of Windows clients, optionally notify users that they should update their VPN
client version. For Windows clients, you can provide a mechanism for users to accomplish that update.
For VPN 3002 hardware client users, the update occurs automatically, with no notification. This
command applies only to the IPsec remote-access tunnel-group type.
To perform a client update, enter the client-update command in either general configuration mode or
tunnel-group ipsec-attributes configuration mode. If the client is already running a software version on
the list of revision numbers, it does not need to update its software. If the client is not running a software
version on the list, it should update. The following procedure explains how to perform a client update:
Step 1 In global configuration mode, enable client update by entering this command:
hostname(config)# client-update enable
hostname(config)#
Step 2 In global configuration mode, specify the parameters for the client update that you want to apply to all
clients of a particular type. That is, specify the type of client, the URL or IP address from which to get
the updated image, and the acceptable revision number or numbers for that client. You can specify up to
four revision numbers, separated by commas.
If the user’s client revision number matches one of the specified revision numbers, there is no need to
update the client. This command specifies the client update values for all clients of the specified type
across the entire ASA.
Use this syntax:
hostname(config)# client-update type type url url-string rev-nums rev-numbers
hostname(config)#
The available client types are win9X (includes Windows 95, Windows 98 and Windows ME platforms),
winnt (includes Windows NT 4.0, Windows 2000 and Windows XP platforms), windows (includes all
Windows based platforms), and vpn3002 (VPN 3002 hardware client).
If the client is already running a software version on the list of revision numbers, it does not need to
update its software. If the client is not running a software version on the list, it should update. You can
specify up to three of these client update entries. The keyword windows covers all of the allowable
Windows platforms. If you specify windows, do not specify the individual Windows client types.