Posture Assessment Failed Unable To Csd Library

by

Hostscan Initialize '/Users failed quot libcsd. An Unable To Download Csd Posture Assessment Failed: Download for MaOS Technica OpenForum university's Posture Assessment Failed Unable AnyConnect client devices to unable to connect cisco py. 1 Hostscan CSD prelogin verification to fix posture assessment webportal and CSD does Assessment. There is actually an option in the AnyConnect client to 'Disable Captive Portal Detection' which, when checked, results in a LOOOONG posture assessment and the following error, 'Posture Assessment Failed: Unable to download CSD library. Please try again'.

Symptom: When the SSL version for the server is set to 'TLS V1 Only', MAC and Linux clients receive the following popup message: 'Posture Assessment Failed: Hostscan CSD prelogin verification failed." Conditions: Mac OSX or Linux Operating Systems Hostscan: 3.1.01065 SSL version for server negotiation set to 'TLS V1 Only' on the ASA. Cisco Posture Assessment Failed Unable To Download Csd Library Mac Os. Hello all I am attempting to get the HostScan posture assessment working so we can check that any device connecting to the ASA is a valid corporate asset. I have installed the posture module onto our test client machine (Windows 8.1) using the. Posture Assessment Failed: Failed to Launch the Hostscan CSD stub. What are my possible fixes for this? I had only downloaded this because I was being told that Mojave (10.14.3) will not support the 32 bit version (which worked just fine).

Contents

Introduction

This document describes how to troubleshoot issues with Java 7 on Cisco AnyConnect Secure Mobility Client, Cisco Secure Desktop (CSD)/Cisco Hostscan, and clientless SSL VPN (WebVPN).

Note: Cisco bug IDs marked as investigative are not restricted to the symptoms described. If you face issues with Java 7, ensure that you upgrade the AnyConnect client version to the latest client version or to at least the 3.1 maintenance release 3 version available on Cisco Connection Online (CCO).

General Troubleshooting

Run the Java Verifier in order to check if Java is supported on the browsers in use. If Java is enabled properly, review the Java console logs in order to analyze the problem.

Windows

This procedure describes how to enable the console logs in Windows:

  1. Open the Windows Control Panel, and search for Java.
  2. Double-click Java (the coffee cup icon). The Java Control Panel appears.
  3. Click the Advanced tab.
    1. Expand Debugging, and select Enable tracing and Enable logging.
    2. Expand Java console, and click Show console.

Mac

This procedure describes how to enable the console logs on a Mac:

  1. Open System Preferences, and double-click the Java icon (coffee cup). The Java Control Panel appears.
  2. Click the Advanced tab.
    1. Under Java console, click Show console.
    2. Under Debugging, click Enable tracing and Enable logging.

Specific Troubleshooting

AnyConnect

For AnyConnect-related issues, collect the Diagnostic AnyConnect Reporting (DART) logs as well as the Java console logs.

Posture assessment failed unable to csd library card

Windows

Cisco bug ID CSCuc55720, 'IE crashes with Java 7 when 3.1.1 package is enabled on the ASA,' was a known issue, where Internet Explorer crashed when a WebLaunch was performed and AnyConnect 3.1 was enabled on the headend. This bug has been fixed.

You might encounter issues when you use some versions of AnyConnect and Java 7 with Java apps. For further information, see Cisco bug ID CSCue48916, 'Java App(s) Break when using AnyConnect 3.1.00495 or 3.1.02026 & Java v7.'

Issues with Java 7 and IPv6 Socket Calls

If AnyConnect does not connect even after you upgrade the Java Runtime Environment (JRE) to Java 7, or if a Java application is unable to connect over the VPN tunnel, review the Java console logs and look for these messages:

These log entries indicate that the client/application makes IPv6 calls.

One solution for this issue is to disable IPv6 (if it is not in use) on the Ethernet adapter and the AnyConnect Virtual Adapter (VA):

A second solution is to configure Java to prefer IPv4 over IPv6. Set the system property 'java.net.preferIPv4Stack' to 'true' as shown in these examples:

  • Add code for the system property to the Java code (for Java applications written by the customer):
  • Add code for the system property from the command line:
  • Set the environment variables _JPI_VM_OPTIONS and _JAVA_OPTIONS in order to include the system property:

For additional information, refer to:

A third solution is to disable IPv6 completely on Windows machines; edit this registry entry:

For additional information, see How to disable IP version 6 or its specific components in Windows.

Issues with AnyConnect WebLaunch After Java 7 Upgrade

Cisco JavaScript code previously looked for Sun as the value for the Java vendor. However, Oracle changed that value as described in JDK7: Java vendor property changes. This issue was fixed by Cisco bug ID CSCub46241, 'AnyConnect weblaunch fails from Internet Explorer with Java 7.'

Mac

No issues have been reported. Tests with AnyConnect 3.1 (with the WebLaunch / Safari / Mac 10.7.4 / Java 7.10 configuration) show no errors.

Miscellaneous

Issues with Java 7 Apps on Cisco AnyConnect

Cisco bug ID CSCue48916, 'Java App(s) Break when using AnyConnect 3.1.00495 or 3.1.02026 & Java v7,' has been filed. Initial investigation indicates that the issues are not a bug on the client side, but might be related to the Java virtual machine (VM) configuration instead.

Previously, in order to use Java 7 apps on the AnyConnect 3.1(2026) client, you unchecked the IPv6 virtual adapter settings. However, it is now necessary to complete all of the steps in this procedure:

  1. Install AnyConnect Version 3.1(2026).
  2. Uninstall Java 7.
  3. Reboot.
  4. Install Java SE 6, update 38, available on the Oracle web site.
  5. Navigate to the Java 6 control panel settings, then click the Update tab to upgrade to the latest version of Java 7.
  6. Open a command prompt and enter:
  7. Log in with AnyConnect, and the Java apps should work.

Note: This procedure has been tested with Java 7 updates 9, 10, and 11.

CSD/Hostscan

For CSD/Hostscan-related issues, collect the DART logs as well as the Java console logs.

In order to obtain the DART logs, the CSD logging level must be turned to debugging on the ASA:

  1. Navigate to ASDM > Configuration > Remote Access VPN > Secure Desktop Manager > Global Settings.
  2. Turn up CSD logging to debugging on the Cisco Adaptive Security Device Manager (ASDM).
  3. Use DART in order to collect the CSD/Hostscan logs.

Windows

Hostscan is susceptible to crashes similar to those described previously for AnyConnect in Windows (Cisco bug ID CSCuc55720). The hostscan issue has been resolved by Cisco bug ID CSCuc48299, 'IE with Java 7 crashes on HostScan Weblaunch.'

Mac

Issues with CSD Versions 3.5.x and Java 7

In CSD 3.5.x, all WebVPN connections fail; this includes AnyConnect web launches. The Java console logs do not reveal any problems:

Posture

If you downgrade to JRE 6 or upgrade CSD to 3.6.6020 or later, the Java console logs do reveal the problems:

The resolution is to upgrade CSD or downgrade Java. Because Cisco recommends that you run the latest version of CSD, you should upgrade CSD, rather than downgrade Java, especially since a Java downgrade can be difficult on a Mac.

Issues with Chrome and Safari with WebLaunch on Mac 10.8

Issues with Chrome and Safari are expected behavior:

  • Chrome is a 32-bit browser and does not support Java 7.
  • Chrome has never been an officially supported browser for WebLaunch.
  • Mac 10.8 disabled the use of Java 7 on Safari, and older versions of Java are not enabled by default.

If you already have Java 7 installed, the resolutions are:

  • Use Firefox.
  • Enable Java 7 on Safari:
    1. Verify that Java 7 is installed on the Mac and that the Mac has been restarted. Open Firefox, and go to the Java Verifier.
    2. Open Safari, and go the Java Verifier again. You should now see this screen:
  • Disable Java 7, and enable Java SE 6 provided by Apple.

Tip: If you do not have Java installed or you have an older version of Java, you are likely to see the error message 'Java blocked for this web site' on java.com . See Java updates available for OS X on August 28, 2013 on the Apple support forum for information on installation of Java updates.

Issues with Safari with WebLaunch on Mac 10.9

If you you are on Mac 10.9 and already have the Java plugin enabled (as described in the Issues with Chrome and Safari with WebLaunch on Mac 10.8 section), the WebLaunch might continue to fail. All Java applets are initiated, but the browser simply continues to spin. If Java logs are enabled as described in the General Troubleshooting section, the logs quickly fill up as shown here:

Look for this type of entry earlier in the log:

This indicates that you are encountering Cisco bug ID CSCuj02425, 'WebLaunch on OSX 10.9 fails if java unsafe mode is disabled.' In order to workaround this issue, modify the Java preferences so Java can run in unsafe mode for Safari:

Posture Assessment Failed Unable To Download Csd Library Mac

  1. Click Preferences.
  2. Click Manage Website Settings.
  3. In the Security tab, select Java, and note that Allow is selected by default.
  4. Change Allow to Run in Unsafe Mode.

WebVPN

For WebVPN issues related to Java, collect this data for troubleshooting purposes:

  • Output from the show tech-support command.
  • Java console logs with and without Adaptive Security Appliance (ASA) as explained in the General Troubleshooting section.
  • WebVPN captures.
  • HTTP watch captures on local machine with and without the ASA.
  • Standard packets captures on the ASA and on the local machine.
    • On the local machine, these captures can be done with Wireshark.
    • For information on how to capture traffic on the ASA, see Configuring Packet Captures.
  • All jar files downloaded to the Java cache when going through the ASA. This is an example from the Java console:
    In this example, 6a0665e9-1f510559.idx is the cached version of mffta.jar 7. If you do not have access to these files, you can collect them from the Java cache when using direct connection.

Posture Assessment Failed Unable To Csd Library System

A test setup can expedite the resolution.

Security Features in Java 7 U51 and How That Affects WebVPN Users

Recently announced changes scheduled for Java 7 update 51 (January 2014) have established that the default security slider requires code signatures and the Permissions Manifest attribute. In summary, all Java applets require:

Download
  • to be signed (Applets and Web Start applications).
  • to set the 'Permissions' attribute within the Manifest.

The applications are affected if it uses Java started through a web browser. Applications run from any where outside a web browser are fine. What this means for WevVPN is all the client plugins that are distributed by Cisco could be impacted. Since these plugins are not maintained or supported by Cisco, Cisco cannot make changes to the code signing certificate or to the applet in order to ensure it complies with these restrictions. The proper solution for this is to use the temporary code signing certificate on the ASA. ASAs provide a temporary code signing certificate to sign Java applets (for Java rewriter and plugins). The temporary certificate lets Java applets perform their intended functions without a warning message. ASA administrators should replace the temporary certificate before it expires with their own code signing certificate issued by a trusted certificate authority (CA). If this is not a viable option, the workaround is to complete these steps:

Posture Assessment Failed Unable To Download Csd Library Cisco Anyconnect

  1. You can use the Exception Site list feature on the end client machine's Java settings in order to run the applications blocked by security settings. The steps to do this are described in Issues with Safari with WebLaunch on Mac 10.9.
  2. You can also lower the Java Security settings. This setting is also set in the client machine's Java settings as shown here:

Warning: The use of the these workarounds still gives you some errors, but Java does not block the application as it would have done without the workarounds in place.

Windows

Posture Assessment Failed Unable To Download Csd Library Mac Catalina

Applications that launch Java applets have been reported to fail over WebVPN after an upgrade to Java 7. This problem is caused by the lack of Secure Hash Algorithm (SHA)-256 support for the Java rewriter. Cisco bug ID CSCud54080, 'SHA-256 support for webvpn Java rewriter,' has been filed for this issue.

Posture Assessment Failed Unable To Csd Library Level

Applications that start Java applets through the portal with Smart Tunnel might fail when JRE7 is used; this is most common with 64-bit systems. In the captures, note that the Java VM sends the packets in clear text, not through the Smart Tunnel connection to the ASA. This has been addressed by Cisco bug ID CSCue17876, 'Some java applets won't connect via smart tunnel on windows with jre1.7.'