Configure custom attributes for Secure Client

Use this task when you need to configure custom attributes for Secure Client clients, such as Per App VPN, update deferment, or dynamic split tunneling, in Secure Firewall Management Center.

This is relevant for environments where device management and application-specific VPN rules are required, and when deploying secure client features that depend on custom attribute objects.

Applicable when integrating MDM-enrolled devices and advanced VPN features.

Before you begin

Ensure that you have done these steps before adding a custom attribute object for Per App VPN:

  • Per App VPN must be properly configured via MDM and each device must be enrolled to the MDM server.

  • Create a base64 encoded string for each app using the Cisco Secure Client Enterprise Application Selector Tool.

    1. Download the Cisco Secure Client Enterprise Application Selector Tool from here.

    2. Open the Application Selection Tool and select the mobile platform from the drop-down menu located on the upper left.

    3. Add rule by entering friendly name and App ID; the other fields are optional.

    4. On the menu bar, click Policy. The encoded base64 rule appears.

    5. Select and copy the policy string, and save it to use later when you create the Secure Client Custom Attributes object.

Procedure

Step 1

Choose Objects > VPN > Custom Attribute.

Step 2

Click Secure Client Custom Attribute.

Step 3

Enter a Name and optionally a Description for the attribute.

Step 4

Select an attribute from the Secure Client Attribute drop-down list:

  • Per App VPN—Select this option and specify the base64 encoded string in the Attribute Value box.

  • Allow Defer Update—Select one of these options and specify the required information to allow or defer Secure Client update:

    • Show the prompt until user takes action—Display the prompt to the VPN user until the user chooses to allow or defer the VPN client update.

    • Show the prompt until times out—Choose this option to display the prompt for a specified duration and specify the duration in the Timeout box.

    • Do not show the prompt and take automatic action—Choose this option to automatically allow or defer the VPN update.

    • Default Action—Select the default action to be taken when the user does not respond, or when you want to configure an automatic action without the user's intervention. You can choose to update the Secure Client or postpone the update.

    • Minimum Version—Specify the minimum Secure Client version to be present on the client system to allow or defer the update.

  • Dynamic Split Tunneling—Select this option to include or exclude IP addresses or networks from the VPN tunnel.

    • Include domains—Specify domain names that will be included in the remote access VPN tunnel.

    • Exclude domains—Specify domain names that will be excluded from the remote access VPN tunnel.

Step 5

Select the Allow Overrides check box to enable object overrides.

Step 6

Click Save.

The custom attributes object is added to the list.

What to do next

Associate the custom attributes with a group policy. See Add custom attributes to your group policy.