You could try killing AnyConnect (and its processes) with a script that runs in your upgrade policy.
We have a connection monitor script that restarts everything if the network is connected but the system can't reach internal DNS.
Since the Secure Mobility Client fires back up so quickly, you may need to put the checkForProcess function in a loop, but here's a chunk of our script showing the process kill logic.
#!/bin/bash
logfile="/var/log/AOVPN_Monitor.log
log () {
echo $1
echo $(date "+%Y-%m-%d %H:%M:%S: ") $1 >> $logfile
}
checkForProcess(){
# Declare an array of string with type
declare -a StringArray=("vpndownloader" "vpn" "vpnagentd" "Cisco AnyConnect Secure Mobility Client")
IFS=""
for val in "${StringArray[@]}"; do
log $val
processname=$(ps aux | grep $val | grep root)
if [ -z "$processname" ]
then
echo "$processname is empty. $val not present."
log "$processname is empty. $val not present. value: $processname"
else
echo "$processname is NOT empty. $val found"
log "$processname $val found. value: $processname"
if [[ "$val" == *.sh* ]]; then
log "Found VPN monitor script. Moving to next process."
else
log "$processname $val going down. killall -kill $processname"
killall -kill $val
fi
fi
reset=$((reset+1))
done
}
checkForProcess
