VPN host address - cisco any connect

[ITTN]

Hi , 

We have recently updated our VPN and would like to update our host address for all macbook across the company through JAMF. I know we can package the profile.xml with cisco any connect installer and assign the profile to everyone but we dont want to go that path. 

Is there a way we can update the host address on all cisco any connect instances for all users much simpler way via jamf ?

Thanks,

[cdev]

If you're leveraging Cisco today, all you would need to do is replace the AnyConnect xml profile with the new version and either quit/relaunch Cisco, or tell your users to restart (I've usually gone the latter route). No need to re-deploy the AnyConnect software itself. Package and deploy the new XML file in /opt/cisco/anyconnect/profile/ and you should be set! Just be sure to replace the existing file or delete the old one – cisco doesn't like having multiple profiles there.

[ITTN]

Thanks @cdev for sharing this. I would greatly appreciate if you can please ellaborate the steps involved in packaging the file and deploying through jamf to replace the xml file .

[jhbush]

@ITTN  you could also use a script vs a package to deploy the new xml profile.

#!/bin/bash

profilePath="/opt/cisco/anyconnect/profile/profilename.xml"

cat > "$profilePath" << EOF
## PUT YOUR XML INFO HERE ##
EOF

/bin/chmod 775 "$profilePath"
/usr/sbin/chown root:wheel "$profilePath"

exit 0

[ITTN]

Hi @jhbush 

I have run the below script but no luck, as the logs says its successfully ran.. can you please identify whats missing, sorry newbie to jamf and scripting

#!/bin/bash

profilePath="/opt/cisco/anyconnect/profile/xyz.xml"

cat > "$profilePath" << EOF
"/Users/xyz/Desktop/anyconnect_profile.xml"
EOF

/bin/chmod 775 "$profilePath"
/usr/sbin/chown root:wheel "$profilePath"

exit 0

[jhbush]

#!/bin/bash

profilePath="/opt/cisco/anyconnect/profile/profilename.xml"

#Delete the XML below and replace with your xml profile text.
cat > "$profilePath" << EOF
<?xml version="1.0" encoding="UTF-8"?>
<AnyConnectProfile xmlns="http://schemas.xmlsoap.org/encoding/">
<ServerList>
     <HostEntry>
          <User>username</User>
          <HostName>host alias name</HostName>
          <HostAddress>host address of vpn</HostAddress>
     </HostEntry>
</ServerList>
</AnyConnectProfile>
EOF

/bin/chmod 775 "$profilePath"
/usr/sbin/chown root:wheel "$profilePath"

exit 0

[ITTN]

@jhbush firstly i really appreciate you on helping me out on this, so this is working partially for all the new machines that are running cisco any connect for the first time but its not replacing the existing profile.xml with this one, like i scoped it to my laptop and it didn't work

[cdev · Accepted solution]

One option to create a deployable package with just the XML profile would be to leverage Jamf Composer on a Mac that has the new/proper XML file on it. Drag that file (from it's proper location at /opt/cisco/anyconnect/profiles/) onto the Composer window to add the file at the proper folder location. Ensure permissions are set properly (root:wheel 644) and then create the .pkg file. Upload to Jamf and deploy via policy. If the new XML file and the old one have the same name, it'll overwrite the old one. Users will need to quit/relaunch Cisco or reboot their Mac for the change to be picked-up.