In short: AnyConnect end of life: Cisco ended software maintenance for AnyConnect 4.x on 31 March 2024, and application software support ends on 31 March 2027. Customers with valid term licences, or perpetual licences with active support contracts, can upgrade to Cisco Secure Client 5 at no extra charge. Check headend compatibility, profiles and packaging first.
The AnyConnect 4.x end-of-life dates
Cisco's end-of-life notice for AnyConnect Secure Mobility Client 4.x sets two milestones:
| Milestone | Date | What it means |
|---|---|---|
| End of software maintenance | 31 March 2024 | No further 4.x maintenance releases or patches, including security fixes |
| End of application software support | 31 March 2027 | Cisco TAC no longer supports 4.x; you must be on a current release to get help |
The product is now Cisco Secure Client, AnyConnect renamed from version 5. Cisco recommends the 5.1 release train and makes version 5 fixes only there, so the realistic target is the current 5.1 release, not an early 5.0 build.
In practice the important date has already passed. Since March 2024, any vulnerability found in a 4.x client stays unfixed, and VPN clients are a favoured target because they sit on every remote device and face the internet. Treat 31 March 2027 as the hard deadline, not the plan.
Who can upgrade at no extra charge
Cisco's notice says customers with valid AnyConnect or Secure Client term licences, or perpetual licences with an active support contract, are eligible to move to the current release at no charge. The licence names change at the same time, with no change of entitlement:
| AnyConnect licence | Secure Client licence |
|---|---|
| AnyConnect Plus | Secure Client Advantage |
| AnyConnect Apex | Secure Client Premier |
| AnyConnect VPN Only | Secure Client VPN Only |
If your licences have lapsed, or you hold perpetual licences without support, you will need to renew or buy before you can download Secure Client. Our Secure Client licensing guide explains the options, and we can review your Smart Account to see what you already hold. Ask us for a quote if anything is missing.
Before you upgrade: what to check
- Headend versions: confirm your Secure Firewall ASA or Secure Firewall Threat Defense software supports Secure Client 5 and the features you use, such as SAML with an external browser or DTLS 1.2, and that older ASA hardware has enough flash for the new packages
- Posture: HostScan is now Secure Firewall Posture, and Cisco does not support mixing HostScan 4.x with Secure Client 5; upgrade posture packages and update DAP or posture policies together
- ISE: if Cisco ISE deploys the client or runs posture, check the ISE version and update the client provisioning resources
- Umbrella module: it still needs the OrgInfo.json file from your dashboard, and if you are moving to Secure Access, plan the profile change at the same time
- Operating systems: retire builds that Secure Client 5.1 no longer supports, and on macOS pre-approve the system extensions through MDM
- Linux: the shell-script installer has been replaced by RPM and DEB packages, so remove script-installed versions first
How to upgrade from AnyConnect to Secure Client
- Inventory the AnyConnect versions, modules and operating systems in use, and the headends and ISE nodes that serve them.
- Confirm entitlement in your Cisco Smart Account and download the current Secure Client 5.1 packages.
- Upgrade headends first where they need it, and upload the Secure Client and Secure Firewall Posture packages to the ASA or to the remote access VPN policy in Management Center.
- Review profiles: open your existing VPN, Network Access Manager and posture profiles in the Secure Client profile editor, tidy them, and make sure names match on every headend and in cloud management.
- Pilot with IT and a small group of users on each platform, testing sign-in (including Duo MFA or SAML), split tunnelling, Start Before Login and posture.
- Choose the rollout method: web deploy from the headend upgrades connected VPN users without admin rights, while managed devices are usually better served by a pre-deploy package through Intune, Configuration Manager or Jamf.
- Roll out in waves, monitor connection and posture reports, then remove the AnyConnect 4.x packages from the headends.
Test the upgrade path on each operating system in the pilot, including how existing AnyConnect profiles and preferences carry across.
A chance to rethink remote access
An end-of-life upgrade touches every remote device, so it is a good moment to ask whether everything still needs a full-tunnel VPN. Secure Client's Zero Trust Access module gives per-application access through Cisco Secure Access ZTNA, and the same agent can keep VPN for the applications that still need it. If the headend itself is old, combine this work with an ASA to Threat Defense migration.
Our wider Cisco security end-of-life guide covers the other renamed and retiring Cisco products. Contact us and we will plan and run your AnyConnect upgrade, from entitlement check to the last device.
How Forever Systems supplies and supports Cisco Secure
We supply and support the whole Cisco security portfolio for UK organisations, alongside Cisco Meraki networking and Cisco voice.
- Architecture and sizing: the right mix of firewall, secure access, identity, endpoint, email, detection and response and OT security for your estate, whether as individual products or a Cisco security suite
- Licensing: Smart Accounts, subscription tiers, Enterprise Agreements and renewals, explained in plain English
- Deployment and migration, including ASA to Secure Firewall Threat Defense, AnyConnect to Secure Client, and Umbrella to Secure Access
- Integration across Cisco XDR, Splunk, Duo, ISE and Secure Access so products share telemetry and response actions
- Ongoing support: upgrades, policy reviews, end-of-life planning, licence management and renewals
Forever Systems Ltd is an independent IT and cyber security provider. We will always recommend what fits, Cisco or otherwise.
Want help choosing, licensing or migrating Cisco security products?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
When does AnyConnect reach end of life?
Software maintenance for AnyConnect 4.x ended on 31 March 2024. Application software support ends on 31 March 2027, after which Cisco will not support 4.x at all.
Is the upgrade from AnyConnect to Secure Client free?
For customers with valid AnyConnect or Secure Client term licences, or perpetual licences with active support contracts, yes: Cisco says there is no extra charge to move to the current Secure Client release.
Will my AnyConnect profiles work with Secure Client?
Generally yes. Existing VPN profiles can be carried forward, but review them in the Secure Client profile editor, update posture packages (HostScan is now Secure Firewall Posture) and make sure profile names match on every headend.
Do I need to upgrade my ASA or firewall for Secure Client 5?
Not always, but check. Some Secure Client features need minimum ASA or Threat Defense versions, and older ASA hardware generations with limited flash need smaller packages or a hardware refresh.
Can I upgrade AnyConnect without admin rights on the device?
Yes, if the headend web-deploys the client. Cisco's guide notes that web-deploy upgrades from an ASA or Threat Defense headend do not need administrator rights. A first-time pre-deploy installation does.