Cisco Secure Client Version Differences (5.0 vs 5.1)

Analysis Date: 2025-10-29 Document Version: 1.0 Analyzed Versions: 5.0.00529 - 5.0.05040, 5.1.0.136 - 5.1.12.146 Purpose: Comprehensive version comparison for ocserv (C23) implementation

Executive Summary
Feature Comparison Matrix
New Features in 5.1
Protocol Changes
Platform Support Changes
Deprecated Features
Critical Bug Fixes
Security Enhancements
Migration Considerations
C23 Implementation Impact

Executive Summary

Cisco Secure Client 5.1 represents a significant evolution from 5.0, introducing:

Zero Trust Access (ZTA) module with TND integration
WPA3 support (CCMP128, GCMP256, SAE transition)
IKEv2 PSK/PPK (RFC 8784) post-quantum pre-shared key
Linux ARM64 platform support
Dynamic Split Tunneling enhancements (include+exclude simultaneously)
NVM enhancements (eBPF, tamper protection, EVE integration)

Critical breaking changes:

AMP Enabler removed from macOS (5.1.10.233)
Windows 10 ARM64 webdeploy discontinued (5.1.2.42)
Ubuntu 20.04 and SUSE 12 dropped (5.1.10.233)
macOS 11 support ended (5.1.3.62)

Feature Comparison Matrix

Core VPN Features

Feature	5.0	5.1	Notes
TLS 1.3	✅ (5.0.01242+)	✅	ASA 9.19.1+ required
IKEv2 PSK/PPK	❌	✅ (5.1.8.105+)	RFC 8784 post-quantum
DTLS 1.2	✅	✅	No DTLS 1.3 support
Dynamic Split Tunneling	❌	✅ (5.1.2.42+)	Include+exclude simultaneously
Split Exclude Failover	❌	✅ (5.1.10.233+)	Route via VPN when external fails
SAML External Browser	✅ (5.0.00529+)	✅	ASA 9.17+ required
Start Before Login (ARM64)	✅ (5.0.01242+)	✅	Windows 10/11 ARM64
Fast User Switching	✅ (5.0.01242+)	✅	Windows

Authentication & Security

Feature	5.0	5.1	Notes
Certificate Template Filtering	❌	✅ (5.1.6.103+)	Template Name/Information/Identifier
WPA3 CCMP128	✅ (5.0.02075+)	✅	OWE and SAE
WPA3 GCMP256	❌	✅ (5.1.4.74+)	Enterprise 256-bit encryption
WPA3 SAE Transition	❌	✅ (5.1.9.113+)	WPA2↔WPA3 mode switching
PMF IGTK Support	Partial	✅ (5.1.4.74+)	Requires OS patches + registry workaround
Dual-Home Detection	Linux/macOS (5.0.03072+)	Linux/macOS/Windows (5.1.4.74+)	Windows added in 5.1

Zero Trust & Visibility

Feature	5.0	5.1	Notes
Zero Trust Access Module	❌	✅ (5.1.0.136+)	Separate download/license
ZTA Certificate Enrollment	❌	✅ (5.1.9.113+)	Auto-enrollment without user action
ZTA Trusted Network Detection	❌	✅ (5.1.10.233+)	Auto-pause ZTA in corporate network
ZTA All Internet	❌	✅ (5.1.11.388+)	Unified SIA enforcement
NVM mDTLS	❌	✅ (5.1.6.103+)	Mutual TLS for collector identity
NVM Tamper Protection	❌	✅ (5.1.7.80+)	XDR binary/app protection
NVM eBPF (Linux)	❌	✅ (5.1.11.388+)	Berkeley Packet Filter kernel integration
NVM EVE Integration	❌	✅ (5.1.9.113+)	EVE record reporting
NVM Process Tree Hierarchy	❌	✅ (5.1.7.80+)	Full lineage with PUID
NVM Endpoint Tags	❌	✅ (5.1.8.105+)	Custom tagging for identification

Platform Support

Platform	5.0	5.1	Notes
Windows 10 ARM64	✅ (5.0.00529+)	⚠️ Webdeploy removed (5.1.2.42)	Predeploy only
Windows 11 ARM64	✅	✅	Full support including ZTA (5.1.7.80+)
macOS 11 (Big Sur)	✅	❌ (Dropped 5.1.3.62)
macOS 12 (Monterey)	✅	❌ (Dropped 5.1.6.103)
macOS 13 (Ventura)	✅	✅
macOS 14 (Sonoma)	✅ (5.0.05040+)	✅
macOS 15 (Sequoia)	❌	✅ (5.1.6.103+)
macOS 26 (Tahoe)	❌	✅ (5.1.12.146+)	Future release
Linux ARM64	❌	✅ (5.1.11.388+)	No FIPS support
Ubuntu 20.04	✅	❌ (Dropped 5.1.10.233)
Ubuntu 22.04/24.04	✅	✅
RHEL 9.x	✅ (5.0.00556+)	✅
RHEL 10.x	❌	✅ (5.1.11.388+)
SLES 12	✅	❌ (Dropped 5.1.10.233)
SLES 15	✅	✅

Modules & Components

Component	5.0	5.1	Notes
AMP Enabler	macOS only	❌ Removed (5.1.10.233)	Replaced by Secure Endpoint
ThousandEyes	✅ (5.0.04032+)	✅	Min 6.3 for ZTA (5.1.10.233+)
Duo Desktop	❌	✅ (5.1.0.136+)	Packaged (formerly Duo Health App)
Docker Support	❌	✅ (5.1.10.233+)	Linux containers
Cloud Management	✅ (5.0.04032+)	✅	Extended to macOS (5.1.4.74)

New Features in 5.1

5.1.0.136 (July 2023)

Zero Trust Access Module: Application hiding/zero trust network access
WPA3 CCMP128 Initial Support: With pending Microsoft PMF fixes
Duo Desktop Packaging: Formerly Duo Health Application

5.1.1.42 (September 2023)

NVM HTTP Host Parameter: For HTTP 1.1 flows (Windows)
NVM Module Name List: Browser plugin detection (Chrome, Firefox, Edge)
macOS Webdeploy Admin Requirement: Due to Apple API changes

5.1.2.42 (November 2023)

Dynamic Split Tunneling: Simultaneous include + exclude
Load Balancing Wildcard Support: At beginning/end of host addresses
PMF IGTK Registry Workaround: DisableIGTK for WPA3 compatibility
Windows 10 ARM64 Webdeploy Discontinued

5.1.3.62 (January 2024)

Umbrella FedRAMP Support: SWG and DNS clients
Bypass Default Localization: Local policy preference
macOS 11 Support Removed
Ubuntu 24.04 LTS Marked Unsupported

5.1.4.74 (March 2024)

Dual-Home Detection (Windows): Disables untrusted interfaces
WPA3 Enterprise GCMP256: Full support with OS patches
Secure Trusted Network Detection: HTTPS probe validation
Cloud Management macOS Extension: Version 1.0.3.433

5.1.5.65 (May 2024)

DART Direct TAC Send: Option to send bundles directly to Cisco TAC
Connection Retry Suppression: Preference to disable periodic reconnects
EDR Skip Internet Check: Pre-VPN posture assessment capability

5.1.6.103 (June 2024)

macOS 15 (Sequoia) Support Announced: macOS 12 dropped
Certificate Template Matching: Template Name/Information/Identifier filtering
mDTLS for NVM: Mutual TLS with identity verification
Advanced Window Tabs: Settings/Web Browser tabs with WebView2 cache clearing
Captive Portal System Proxy Disabled: macOS 14+ authentication fix

5.1.7.80 (August 2024)

ThousandEyes 1.219.1: ZTA integration + ThousandEyes.json profile
NVM Tamper Protection (Windows): XDR binary/app protection
Windows 11 24H2 Location Permission: Required for some modules
NVM Process Tree Hierarchy: Full lineage with PUID
Pre-deploy Requirement: No registry removal during upgrades
Windows ARM64 ZTA Support
macOS Embedded Browser System Proxy Override

5.1.8.105 (September 2024)

Always-On Linux Support: Specified host access when VPN disconnected
IKEv2 PSK & Post-Quantum PPK: RFC 8784 authentication
macOS ZTA Approval Requirement: User must approve ZTA
ThousandEyes JSON Profile: Deployment via Downloader (Windows)
Umbrella China Region: Regional boundary support
macOS Dynamic Split Tunneling CNAME Control: Admin-controlled DNS response splitting
Linux Docker Logging: Activation support
Embedded Browser Cache Manual Clearing: Windows/macOS
NVM Endpoint Tags: Custom endpoint identification

5.1.8.122 (September 2024 - Critical)

ZTA Certificate Renewal Fix: CSCwo32464 connectivity loss resolved
Umbrella Encryption Compatibility Fix
REPLACES 5.1.8.105 - MANDATORY UPGRADE

5.1.9.113 (October 2024)

ZTA Certificate Enrollment: Auto-enrollment without user action
WPA3 SAE Transition: WPA2↔WPA3 mode switching with TDI
NVM EVE Integration: EVE record reporting
NVM Linux Browser Plugins: Browser plugin detection
Windows Server 2022: NVM on-prem and XDR support
HTTP Header Exclusion: Default policy for NVM
IPv4 Link-Local Mapping: Umbrella SWG exception list

5.1.10.233 (November 2024)

TND in ZTA: Auto-pause ZTA in corporate network
Split Exclude Failover: Route via VPN when external fails
NVM Tamper Protection ARM64: Windows ARM64 support
NVM Cloud Deployment: Standalone XDR without VPN
AMP Enabler Removed: macOS no longer includes AMP Enabler
Docker Support: Linux container deployment
FIPS Mode for Posture: Local policy enablement
WFP Sublayer Weight: Configurable via acsocktool.exe -slwm
Ubuntu 20.04 & SUSE 12 Removed
ThousandEyes 6.3+ Required: For ZTA

5.1.11.388 (December 2024)

ZTA for All Internet: Unified SIA enforcement
Linux ARM64: Full support (no FIPS 140-2/140-3)
NVM eBPF: Berkeley Packet Filter for Linux kernel
Healthcare Integration: Imprivata badge system on SWG
Threat Defense Management: Universal ZTNA via on-prem proxies
RHEL 10.x Support
Platform Option Import: ARM64 Windows/Linux support

5.1.12.146 (January 2025)

Captive Portal Detection Improved: CSCwj43435 fix
macOS 26 (Tahoe) Support: Future release support announced

Protocol Changes

TLS/DTLS Evolution

5.0 Baseline:

TLS 1.3 support added in 5.0.01242
Ciphers: TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384
DTLS 1.2 only (no DTLS 1.3)
ISE Posture doesn't support TLS 1.3

5.1 Enhancements:

No new TLS versions
Same cipher suites
DTLS 1.2 remains maximum
IKEv2 PSK/PPK added (5.1.8.105) - RFC 8784 post-quantum pre-shared key

X-CSTP Headers

No documented protocol changes in X-CSTP headers between 5.0 and 5.1.

X-DTLS Headers

No documented protocol changes in X-DTLS headers between 5.0 and 5.1.

DPD Mechanism Changes

5.0 Behavior:

Standard DPD at 30-second intervals
Three missed retries trigger failover during establishment
Post-establishment: missed DPDs don't impact tunnel

5.1 Behavior:

No documented changes to DPD intervals or logic
Same behavior maintained

MTU Handling

No documented changes in MTU discovery or handling between versions.

New Protocol: IKEv2 PSK/PPK (5.1.8.105)

// RFC 8784: Post-Quantum Pre-Shared Keys for IKEv2
// Added in Cisco Secure Client 5.1.8.105

typedef struct {
    uint8_t psk_id[32];        // Pre-shared key identifier
    uint8_t ppk[64];           // Post-quantum pre-shared key (512 bits)
    uint8_t prf_output[64];    // PRF output for key derivation
} ike_ppk_t;

// C23 Implementation for ocserv
[[nodiscard]] int handle_ikev2_ppk(
    const uint8_t *psk_id,
    size_t psk_id_len,
    const uint8_t *ppk,
    size_t ppk_len,
    uint8_t *derived_key
) {
    if (psk_id == nullptr || ppk == nullptr || derived_key == nullptr) {
        return -EINVAL;
    }

    // RFC 8784 key derivation
    // SKEYSEED = prf(Ni | Nr, g^ir | PPK)
    // Where PPK is the post-quantum pre-shared key

    // Implementation would use PRF+ for key material generation
    // and combine with traditional DH output

    return 0;
}

Platform Support Changes

Windows

Change	Version	Impact
Windows 10 ARM64 Webdeploy Removed	5.1.2.42	Must use predeploy packages
Windows 11 ARM64 ZTA Added	5.1.7.80	Full ZTA support on ARM64
Windows 11 24H2 Location Permission	5.1.7.80	Required for NAM, NVM, ISE Posture
Dual-Home Detection Added	5.1.4.74	Disables untrusted interfaces
NVM Tamper Protection ARM64	5.1.10.233	XDR protection on ARM64
WFP Sublayer Weight Tuning	5.1.10.233	acsocktool.exe -slwm multiplier 1-10

C23 Implementation Notes:

ARM64 binary compilation required for Windows on ARM
WFP driver requires signed kernel-mode driver
Location permission detection via Windows.Services.Location API

macOS

Change	Version	Impact
macOS 11 Support Dropped	5.1.3.62	Minimum now macOS 12
macOS 12 Support Dropped	5.1.6.103	Minimum now macOS 13
macOS 15 (Sequoia) Added	5.1.6.103	Latest OS support
macOS 26 (Tahoe) Added	5.1.12.146	Future release support
Webdeploy Admin Requirement	5.1.1.42	Apple API changes
ZTA Approval Requirement	5.1.8.105	User must approve ZTA
Captive Portal Proxy Disabled	5.1.6.103	macOS 14+ authentication fix
AMP Enabler Removed	5.1.10.233	Use Secure Endpoint

C23 Implementation Notes:

macOS 13+ requires Network Extension entitlements
System Extension API for VPN (not KEXT)
Keychain integration for certificate storage
TCC (Transparency, Consent, and Control) for ZTA approval

Linux

Change	Version	Impact
ARM64 Support Added	5.1.11.388	Full ARM64 support
Ubuntu 20.04 Dropped	5.1.10.233	Minimum now 22.04
Ubuntu 24.04 Added	Referenced	Latest LTS support
SUSE 12 Dropped	5.1.10.233	Minimum now SLES 15
RHEL 10.x Added	5.1.11.388	Latest RHEL support
Docker Support Added	5.1.10.233	Container deployment
Always-On Added	5.1.8.105	Specified host access
NVM eBPF Added	5.1.11.388	Kernel BPF integration

C23 Implementation Notes:

ARM64 cross-compilation required (aarch64-linux-gnu)
eBPF loader for NVM packet filtering
No FIPS 140-2/140-3 support on ARM64
NSS certificate store limitation on Ubuntu ARM64 (CSCwq74514)
systemd + libsystemd mandatory

iOS

No version-specific changes documented in 5.1 release notes. iOS Secure Client maintains separate release cycle (5.0.x continues).

Key iOS Limitations (from 5.0.x):

Per-App VPN requires iOS 10.3+
Zero Trust Access requires iOS/iPadOS 17.2+
No OCSP validation support
No smart card support
Local LAN access always enabled (iOS limitation)
Split tunneling fails in IPv6-only with split-exclude

Deprecated Features

Removed in 5.1

AMP Enabler (macOS) - Version 5.1.10.233
- Reason: Replaced by full Secure Endpoint integration
- Migration: Deploy Cisco Secure Endpoint for macOS
- Impact: No automatic malware protection without Secure Endpoint
Windows 10 ARM64 Webdeploy - Version 5.1.2.42
- Reason: Technical limitations with weblaunch on ARM64
- Migration: Use predeploy MSI packages
- Impact: Cannot deploy via ASA weblaunch
macOS 11 (Big Sur) Support - Version 5.1.3.62
- Reason: Apple API changes, security requirements
- Migration: Upgrade to macOS 12+ (12 later dropped in 5.1.6.103)
- Impact: Users on macOS 11 cannot upgrade past 5.1.2.42
macOS 12 (Monterey) Support - Version 5.1.6.103
- Reason: Apple deprecation, OS feature requirements
- Migration: Upgrade to macOS 13+
- Impact: Users on macOS 12 cannot upgrade past 5.1.5.65
Ubuntu 20.04 LTS Support - Version 5.1.10.233
- Reason: EOL approaching, library version requirements
- Migration: Upgrade to Ubuntu 22.04 LTS
- Impact: No security updates for 20.04 users
SUSE Linux Enterprise Server 12 Support - Version 5.1.10.233
- Reason: EOL, systemd version requirements
- Migration: Upgrade to SLES 15
- Impact: No support for SLES 12

Changed Behavior in 5.1

HTTP Headers in NVM - Version 5.1.9.113
- Change: HTTP headers now excluded by default in data collection
- Reason: Privacy concerns, data volume reduction
- Impact: Custom policies needed to capture HTTP headers
IPv4 Link-Local Mapping (Umbrella) - Version 5.1.9.113
- Change: 169.254.0.0/16 added to SWG exception list
- Reason: Link-local traffic should not be proxied
- Impact: Link-local traffic no longer routed to Umbrella
macOS Captive Portal System Proxy - Version 5.1.6.103
- Change: Disabled on macOS 14+
- Reason: Prevents captive portal authentication issues
- Impact: Captive portals may behave differently
Pre-Deploy Registry Handling - Version 5.1.7.80
- Change: No registry removal during upgrades
- Reason: Preserve configuration across upgrades
- Impact: Manual cleanup required for clean uninstall

Deprecated in 5.0 (Continued in 5.1)

ActiveX Controls - Removed in 5.0.00529
- Status: Still removed in 5.1
- Alternative: Web deployment via modern browsers
Umbrella Automatic Module Updates - Removed in 5.0.00529
- Status: Still removed in 5.1
- Alternative: Manual module updates via SecureX/Cloud Management
Network Access Manager Profile Editor in SecureX - Unavailable in 5.0
- Status: Still unavailable in 5.1
- Alternative: Use standalone Profile Editor

Critical Bug Fixes

Security-Critical (CVE-Level)

No specific CVEs documented in release notes. However, regular security updates included in maintenance releases.

Connectivity-Critical

CSCwo32464 (Fixed in 5.1.8.122)
- Issue: ZTA certificate renewal causing connectivity loss
- Impact: Users lose all connectivity after certificate renewal
- Severity: CRITICAL
- Workaround: None - mandatory upgrade to 5.1.8.122
- Fix: Certificate renewal logic corrected
Umbrella Encryption Incompatibility (Fixed in 5.1.8.122)
- Issue: Umbrella encryption causing connection failures
- Impact: VPN sessions fail with Umbrella enabled
- Severity: HIGH
- Workaround: Disable Umbrella temporarily
- Fix: Encryption negotiation corrected
CSCwj92612 (5.1.3.62+)
- Issue: ISE Posture predeploy/webdeploy broken on non-English Windows 10/11
- Impact: Posture module fails to install on localized Windows
- Severity: HIGH
- Workaround: Use English Windows for deployment
- Status: OPEN as of 5.1.12.146

Platform-Specific

CSCwn39981 (5.1.7.80+)
- Issue: RPM uninstall causes black screen/hang on RHEL/SUSE
- Impact: System becomes unresponsive during uninstall
- Severity: HIGH
- Workaround: Use kill -9 on uninstall script, manual cleanup
- Status: OPEN as of 5.1.12.146
CSCwq74514 (5.1.11.388)
- Issue: Ubuntu ARM64 NSS certificate store limitation
- Impact: Certificate authentication fails on Ubuntu ARM64
- Severity: MEDIUM
- Workaround: Use PEM certificate store
- Status: OPEN (architectural limitation)
CSCwm53109 (5.1.6.103)
- Issue: mTLS fails with CA-signed intermediate certificates
- Impact: NVM mTLS connections fail to collector
- Severity: MEDIUM
- Workaround: Use self-signed collector certificates
- Status: Fixed in later 5.1.6.x

ZTA/QUIC Issues (Persistent)

CSCwn72336, CSCwn92376, CSCwn92381 (5.1.8.105+)
- Issue: ZTA QUIC flow counting, stepup auth, proxy alerts
- Impact: ZTA functionality degraded with QUIC protocol
- Severity: MEDIUM
- Workaround: None documented
- Status: OPEN as of 5.1.12.146

Protocol-Specific

CSCvi07066 (ISE 2.4p5+)
- Issue: EAP-FAST TLS 1.2 defect in ISE
- Impact: ISE posture fails with EAP-FAST and TLS 1.2
- Severity: HIGH
- Workaround: Use TLS 1.0/1.1 (deprecated) or EAP-TLS
- Status: Fixed in ISE 2.4 Patch 5+ (CSCvm03681)

macOS-Specific

CSCwm50228 (5.1.6.103)
- Issue: NVM reports different process names on macOS 15
- Impact: Process tracking inconsistent
- Severity: LOW
- Workaround: Update NVM policies for macOS 15 names
- Status: Documented behavior
CSCwm12254 (5.1.6.108)
- Issue: Gatekeeper firewall remediation non-functional
- Impact: Posture remediation fails for firewall checks
- Severity: MEDIUM
- Workaround: Manual firewall enablement
- Status: OPEN
CSCwi49850 (5.1.1.42)
- Issue: Hyperlinks broken in captive portal browser on macOS 12
- Impact: Cannot click links in captive portal
- Severity: MEDIUM
- Workaround: Use external browser
- Status: Fixed in 5.1.2.42+

Windows-Specific

CSCwm61544 (5.1.6.108)
- Issue: Posture false-positive firewall detection
- Impact: Compliant systems marked non-compliant
- Severity: MEDIUM
- Workaround: Adjust posture policy thresholds
- Status: OPEN
CSCwm83734 (5.1.6.108)
- Issue: Firewall remediation failure on first upgrade attempt
- Impact: Requires second upgrade attempt
- Severity: LOW
- Workaround: Run upgrade twice
- Status: OPEN

Linux-Specific

CSCwj81971 (5.1.3.62)
- Issue: NVM installation fails on Ubuntu 22.04.4
- Impact: Cannot deploy NVM on specific Ubuntu kernel
- Severity: HIGH
- Workaround: Use Ubuntu 22.04.3 or 22.04.5
- Status: Fixed in 5.1.4.74+

Captive Portal

CSCwj43435 (Fixed in 5.1.12.146)
- Issue: Captive portal detection failures
- Impact: Cannot detect/handle captive portals properly
- Severity: MEDIUM
- Workaround: Manual browser authentication
- Status: FIXED

Security Enhancements

Cryptographic Improvements

Post-Quantum Cryptography (5.1.8.105)
- Feature: IKEv2 PPK (RFC 8784)
- Benefit: Quantum-resistant pre-shared key authentication
- Implementation: Adds PPK to traditional IKEv2 key exchange
WPA3 GCMP256 (5.1.4.74)
- Feature: 256-bit Galois/Counter Mode encryption
- Benefit: Stronger wireless encryption than CCMP128
- Requirements: OS patches (Windows 10 22H2 KB5036979+, Windows 11 KB5036980)
Certificate Template Filtering (5.1.6.103)
- Feature: Template Name/Information/Identifier matching
- Benefit: More granular certificate selection
- Use Case: Multi-certificate environments with role-based certs
mDTLS for NVM (5.1.6.103)
- Feature: Mutual TLS with identity verification
- Benefit: Prevents man-in-the-middle attacks on telemetry
- Implementation: Collector certificate validation

Network Security

Dual-Home Detection (Windows) (5.1.4.74)
- Feature: Disables untrusted network interfaces
- Benefit: Prevents data leakage via secondary interfaces
- Mechanism: HTTPS probe to trusted servers
Split Exclude Failover (5.1.10.233)
- Feature: Routes split-exclude traffic via VPN when external fails
- Benefit: Maintains connectivity during internet outages
- Use Case: Branch offices with unreliable internet
NVM Tamper Protection (5.1.7.80)
- Feature: XDR binary/app protection
- Benefit: Prevents malware from disabling visibility
- Platform: Windows (5.1.7.80), Windows ARM64 (5.1.10.233)

Identity & Access

ZTA Certificate Enrollment (5.1.9.113)
- Feature: Auto-enrollment without user action
- Benefit: Seamless zero trust onboarding
- Mechanism: Certificate-based enrollment
ZTA Trusted Network Detection (5.1.10.233)
- Feature: Auto-pause ZTA in corporate network
- Benefit: Reduces unnecessary zero trust overhead
- Mechanism: Network location detection
FIPS Mode for Posture (5.1.10.233)
- Feature: Local policy FIPS enablement
- Benefit: Federal compliance for posture assessments
- Implementation: CSCwo59154 fix

Audit & Compliance

NVM Process Tree Hierarchy (5.1.7.80)
- Feature: Full process lineage with PUID
- Benefit: Complete audit trail for process activities
- Use Case: Forensic analysis, threat hunting
NVM EVE Integration (5.1.9.113)
- Feature: EVE record reporting capability
- Benefit: Enhanced event correlation with SIEM
- Format: EVE (Extensible Event Format)
VPAT Compliance (5.1.8.105)
- Feature: Accessibility enhancements
- Benefit: Section 508 compliance
- Impact: Government/enterprise procurement requirements

Migration Considerations

Upgrading from 5.0 to 5.1

Pre-Migration Checklist

Platform Compatibility
- ✅ Verify OS version support (see Platform Support Changes)
- ✅ Check ARM64 deployment method (predeploy only for Windows)
- ✅ Verify macOS minimum version (13+)
- ✅ Check Linux distribution support (Ubuntu 22.04+, RHEL 9+, SLES 15)
Module Compatibility
- ✅ Remove AMP Enabler on macOS (manual uninstall before upgrade)
- ✅ Check ThousandEyes version (6.3+ required for ZTA)
- ✅ Verify ISE Compliance Module versions
Configuration Compatibility
- ✅ Review custom attributes (UseLocalProfileAsAlternative)
- ✅ Check certificate template filtering if using multi-cert auth
- ✅ Review split tunneling configuration (new dynamic capabilities)
- ✅ Verify DPD and keepalive settings (no changes, but validate)
Security Considerations
- ✅ Plan for dual-home detection on Windows (may block secondary interfaces)
- ✅ Review WPA3 requirements (OS patches for GCMP256)
- ✅ Check NVM HTTP header policy (now excluded by default)
- ✅ Verify FIPS mode requirements for posture

Migration Path by Platform

Windows:

# 1. Backup current configuration
copy "%ALLUSERSPROFILE%\Cisco\Cisco Secure Client\*" "C:\Backup\CiscoSecureClient\"

# 2. Download 5.1.x predeploy package
# https://software.cisco.com/download/home

# 3. Uninstall 5.0 (optional - upgrade supported)
msiexec /x {GUID} /qn /norestart

# 4. Install 5.1.x
msiexec /i cisco-secure-client-win-5.1.x.x-core-vpn-predeploy-k9.msi /norestart /passive

# 5. Restore profiles if needed
copy "C:\Backup\CiscoSecureClient\VPN\Profile\*.xml" "%ALLUSERSPROFILE%\Cisco\Cisco Secure Client\VPN\Profile\"

# 6. Regenerate UDID if VM (VMs only)
"C:\Program Files (x86)\Cisco\Cisco Secure Client\DART\dartcli.exe" -newudid

# 7. Verify installation
"C:\Program Files (x86)\Cisco\Cisco Secure Client\vpnui.exe" --version

macOS:

# 1. Backup current configuration
sudo cp -R /opt/cisco/secureclient/ /tmp/secureclient_backup/

# 2. Uninstall AMP Enabler (if installed)
sudo /opt/cisco/amp/bin/ampcli uninstall

# 3. Download 5.1.x DMG
# https://software.cisco.com/download/home

# 4. Install 5.1.x (requires admin privileges for 5.1.1.42+)
sudo installer -pkg "cisco-secure-client-macos-5.1.x.x.pkg" -target /

# 5. Approve system extensions
# System Settings &gt; Privacy & Security &gt; Allow extensions

# 6. Approve ZTA if needed (5.1.8.105+)
# System Settings &gt; Privacy & Security &gt; Network Extensions &gt; Cisco Zero Trust Access

# 7. Restore profiles if needed
sudo cp /tmp/secureclient_backup/vpn/profile/*.xml /opt/cisco/secureclient/vpn/profile/

# 8. Verify installation
/opt/cisco/secureclient/bin/vpn --version

Linux:

# 1. Backup current configuration
sudo cp -R /opt/cisco/secureclient/ /tmp/secureclient_backup/

# 2. Uninstall 5.0 (if using script installer)
sudo /opt/cisco/secureclient/bin/vpn_uninstall.sh

# 3. Download 5.1.x package
# https://software.cisco.com/download/home

# 4. Install 5.1.x (script method)
tar -xzf cisco-secure-client-linux64-5.1.x.x-core-vpn-predeploy-k9.tar.gz
cd cisco-secure-client-linux64-5.1.x.x-core-vpn-predeploy-k9
sudo ./install.sh

# OR Install 5.1.x (RPM method - RHEL/SUSE)
sudo rpm -ivh cisco-secure-client-linux64-5.1.x.x-core-vpn-predeploy-k9.rpm

# OR Install 5.1.x (DEB method - Ubuntu/Debian)
sudo dpkg -i cisco-secure-client-linux64-5.1.x.x-core-vpn-predeploy-k9.deb
sudo apt-get install -f  # Fix dependencies

# 5. Restore profiles if needed
sudo cp /tmp/secureclient_backup/vpn/profile/*.xml /opt/cisco/secureclient/vpn/profile/

# 6. Enable systemd services
sudo systemctl enable cisco-secure-client-daemon.service
sudo systemctl start cisco-secure-client-daemon.service

# 7. Verify installation
/opt/cisco/secureclient/bin/vpn --version

Post-Migration Validation

VPN Connectivity

# Test basic connection
# Windows: C:\Program Files (x86)\Cisco\Cisco Secure Client\vpncli.exe
# macOS/Linux: /opt/cisco/secureclient/bin/vpn

vpn connect <server_url>
vpn state
vpn disconnect

Certificate Validation
- Test certificate-based authentication
- Verify template filtering if configured
- Check multi-certificate selection
Split Tunneling
- Verify split-include networks route through VPN
- Verify split-exclude networks route direct
- Test dynamic split tunneling (include+exclude)
DPD and Keepalive
- Monitor connection stability
- Check DPD messages in logs
- Verify keepalive intervals
Module Functionality
- NVM: Verify telemetry collection
- ISE Posture: Test posture assessment
- ZTA: Verify zero trust access (if applicable)
- Umbrella: Test SWG/DNS functionality
Platform-Specific
- Windows: Check dual-home detection behavior
- macOS: Verify system extension approvals
- Linux: Test eBPF functionality (5.1.11.388+)

Known Migration Issues

Windows 11 ARM64 Webdeploy
- Issue: Upgrade from 5.1.0.x to 5.1.1.x requires uninstall/reinstall
- Solution: Use predeploy packages for all ARM64 deployments
macOS Webdeploy Admin Privileges
- Issue: 5.0.x → 5.1.x webdeploy requires admin (CSCwi69393)
- Solution: Use predeploy packages or grant temporary admin rights
Pre-Deploy Registry Persistence
- Issue: Registry not removed during upgrades (5.1.7.80+)
- Solution: Manual cleanup required for clean uninstall
ZTA Certificate Renewal
- Issue: 5.1.8.105 users MUST upgrade to 5.1.8.122
- Solution: Mandatory upgrade to avoid connectivity loss

Rollback Plan

If migration fails or issues occur:

Uninstall 5.1.x

# Windows
msiexec /x {5.1_GUID} /qn /norestart

# macOS
sudo /opt/cisco/secureclient/bin/vpn_uninstall.sh

# Linux (script)
sudo /opt/cisco/secureclient/bin/vpn_uninstall.sh

# Linux (RPM)
sudo rpm -e cisco-secure-client-core

# Linux (DEB)
sudo dpkg -r cisco-secure-client-core

Reinstall 5.0.x
- Download last known good 5.0.x version
- Install using same method as 5.1.x
- Restore backed-up configuration

Restore Configuration

# Windows
copy "C:\Backup\CiscoSecureClient\*" "%ALLUSERSPROFILE%\Cisco\Cisco Secure Client\"

# macOS/Linux
sudo cp -R /tmp/secureclient_backup/* /opt/cisco/secureclient/

C23 Implementation Impact

Code Changes Required for 5.1 Features

1. Dynamic Split Tunneling (5.1.2.42)

Feature: Simultaneous include + exclude split tunneling.

Implementation:

// wolfguard/src/vpn/split_tunnel.c

#include <stdint.h>
#include <stdbool.h>

typedef struct {
    uint32_t network;           // Network address (host byte order)
    uint32_t netmask;           // Network mask (host byte order)
    bool is_include;            // true = include, false = exclude
    uint8_t priority;           // Route priority (0 = highest)
} split_route_t;

typedef struct {
    split_route_t *routes;      // Array of routes
    size_t count;               // Number of routes
    size_t capacity;            // Allocated capacity
    bool dynamic_enabled;       // Dynamic split tunneling enabled
} split_tunnel_config_t;

// C23: Dynamic split tunneling decision engine
[[nodiscard]] static inline bool route_should_tunnel(
    const split_tunnel_config_t *config,
    uint32_t dest_ip
) {
    if (config == nullptr || config->routes == nullptr) {
        return false;  // Default: no tunnel
    }

    // Priority: Specific routes take precedence over general routes
    // Algorithm:
    // 1. Check all exclude routes (specific to general)
    // 2. Check all include routes (specific to general)
    // 3. Default behavior based on mode

    bool found_exclude = false;
    bool found_include = false;
    uint8_t best_exclude_prefix = 0;
    uint8_t best_include_prefix = 0;

    for (size_t i = 0; i < config->count; i++) {
        const split_route_t *route = &config->routes[i];

        // Check if destination matches this route
        if ((dest_ip & route->netmask) == (route->network & route->netmask)) {
            uint8_t prefix_len = __builtin_popcount(route->netmask);

            if (route->is_include) {
                if (!found_include || prefix_len &gt; best_include_prefix) {
                    found_include = true;
                    best_include_prefix = prefix_len;
                }
            } else {
                if (!found_exclude || prefix_len &gt; best_exclude_prefix) {
                    found_exclude = true;
                    best_exclude_prefix = prefix_len;
                }
            }
        }
    }

    // Decision logic: Most specific route wins
    if (found_exclude && found_include) {
        return best_include_prefix &gt; best_exclude_prefix;
    }

    if (found_exclude) {
        return false;  // Explicitly excluded
    }

    if (found_include) {
        return true;   // Explicitly included
    }

    // Default: depends on tunnel mode
    return config->dynamic_enabled;  // Full tunnel if dynamic disabled
}

// Example usage
int apply_split_tunneling(struct worker_st *ws) {
    split_tunnel_config_t *config = &ws->split_tunnel;

    // Route packets based on destination
    uint32_t dest_ip = get_packet_dest_ip(ws->packet);

    if (route_should_tunnel(config, dest_ip)) {
        return route_via_tunnel(ws, ws->packet);
    } else {
        return route_direct(ws, ws->packet);
    }
}

XML Profile Parsing:

// Parse dynamic split tunnel configuration from XML profile
int parse_dynamic_split_tunnel(
    xmlNodePtr node,
    split_tunnel_config_t *config
) {
    xmlNodePtr child = node->children;

    while (child != nullptr) {
        if (xmlStrcmp(child->name, (const xmlChar *)"SplitInclude") == 0) {
            // Parse include network
            char *network = xmlNodeGetContent(child);
            add_split_route(config, network, true);
            xmlFree(network);
        } else if (xmlStrcmp(child->name, (const xmlChar *)"SplitExclude") == 0) {
            // Parse exclude network
            char *network = xmlNodeGetContent(child);
            add_split_route(config, network, false);
            xmlFree(network);
        }
        child = child->next;
    }

    return 0;
}

2. IKEv2 PSK/PPK (5.1.8.105)

Feature: RFC 8784 post-quantum pre-shared keys.

Implementation:

// wolfguard/src/crypto/ikev2_ppk.c

#include <openssl/evp.h>
#include <openssl/kdf.h>

#define PPK_MAX_LEN 256  // 2048 bits maximum

typedef struct {
    uint8_t psk_id[64];         // Pre-shared key identifier
    size_t psk_id_len;
    uint8_t ppk[PPK_MAX_LEN];   // Post-quantum pre-shared key
    size_t ppk_len;
    bool ppk_enabled;
} ikev2_ppk_config_t;

// RFC 8784 Section 3: PPK_ID payload format
typedef struct __attribute__((packed)) {
    uint8_t next_payload;
    uint8_t critical_reserved;
    uint16_t payload_length;
    uint8_t ppk_id_type;        // 1 = opaque, 2 = FQDN, 3 = email
    uint8_t reserved[3];
    uint8_t ppk_id_data[];      // Variable length
} ikev2_ppk_id_payload_t;

// RFC 8784 Section 3: PPK payload format
typedef struct __attribute__((packed)) {
    uint8_t next_payload;
    uint8_t critical_reserved;
    uint16_t payload_length;
    uint8_t ppk_data[];         // Variable length
} ikev2_ppk_payload_t;

// C23: Generate PPK-augmented SKEYSEED
[[nodiscard]] int ikev2_ppk_derive_skeyseed(
    const uint8_t *dh_secret,    // Traditional DH shared secret
    size_t dh_secret_len,
    const uint8_t *ppk,          // Post-quantum pre-shared key
    size_t ppk_len,
    const uint8_t *nonce_i,      // Initiator nonce
    size_t nonce_i_len,
    const uint8_t *nonce_r,      // Responder nonce
    size_t nonce_r_len,
    uint8_t *skeyseed,           // Output buffer
    size_t skeyseed_len
) {
    if (dh_secret == nullptr || ppk == nullptr ||
        nonce_i == nullptr || nonce_r == nullptr || skeyseed == nullptr) {
        return -EINVAL;
    }

    // RFC 8784 Section 3.1:
    // SKEYSEED = prf(Ni | Nr, g^ir | PPK)
    // Where:
    //   Ni | Nr = concatenated nonces
    //   g^ir = DH shared secret
    //   PPK = post-quantum pre-shared key

    EVP_KDF *kdf = EVP_KDF_fetch(nullptr, "HKDF", nullptr);
    if (kdf == nullptr) {
        return -ENOMEM;
    }

    EVP_KDF_CTX *kctx = EVP_KDF_CTX_new(kdf);
    if (kctx == nullptr) {
        EVP_KDF_free(kdf);
        return -ENOMEM;
    }

    // Concatenate nonces for salt
    uint8_t salt[512];
    size_t salt_len = 0;

    memcpy(salt, nonce_i, nonce_i_len);
    salt_len += nonce_i_len;
    memcpy(salt + salt_len, nonce_r, nonce_r_len);
    salt_len += nonce_r_len;

    // Concatenate DH secret and PPK for key material
    uint8_t key_material[4096];
    size_t key_material_len = 0;

    memcpy(key_material, dh_secret, dh_secret_len);
    key_material_len += dh_secret_len;
    memcpy(key_material + key_material_len, ppk, ppk_len);
    key_material_len += ppk_len;

    // Set HKDF parameters
    OSSL_PARAM params[] = {
        OSSL_PARAM_construct_octet_string("salt", salt, salt_len),
        OSSL_PARAM_construct_octet_string("key", key_material, key_material_len),
        OSSL_PARAM_construct_utf8_string("digest", "SHA256", 0),
        OSSL_PARAM_construct_end()
    };

    int ret = 0;
    if (EVP_KDF_derive(kctx, skeyseed, skeyseed_len, params) <= 0) {
        ret = -EIO;
    }

    EVP_KDF_CTX_free(kctx);
    EVP_KDF_free(kdf);

    // Clear sensitive data
    explicit_bzero(salt, sizeof(salt));
    explicit_bzero(key_material, sizeof(key_material));

    return ret;
}

// Parse PPK configuration from profile
int parse_ikev2_ppk_config(
    const char *profile_path,
    ikev2_ppk_config_t *config
) {
    // Read PPK configuration from XML profile
    // <IKEv2>
    //   <PPKEnabled>true</PPKEnabled>
    //   <PPKID>base64_encoded_id</PPKID>
    //   <PPKValue>base64_encoded_ppk</PPKValue>
    // </IKEv2>

    // Implementation would parse XML and base64-decode values

    return 0;
}

3. Split Exclude Failover (5.1.10.233)

Feature: Route split-exclude traffic via VPN when external connectivity fails.

Implementation:

// wolfguard/src/vpn/split_exclude_failover.c

#include <stdbool.h>
#include <time.h>

typedef struct {
    bool enabled;                   // Failover enabled
    uint32_t probe_interval_sec;    // Probe interval (default 60s)
    uint32_t probe_timeout_sec;     // Probe timeout (default 5s)
    uint32_t failure_threshold;     // Consecutive failures to trigger (default 3)
    char probe_urls[10][256];       // URLs to probe
    size_t probe_url_count;
    bool is_failed_over;            // Currently in failover mode
    uint32_t consecutive_failures;
    time_t last_probe_time;
} split_exclude_failover_t;

// C23: Probe external connectivity
[[nodiscard]] static bool probe_external_connectivity(
    const split_exclude_failover_t *failover
) {
    if (failover == nullptr || failover->probe_url_count == 0) {
        return true;  // Assume connectivity if no probes configured
    }

    // Try each probe URL
    for (size_t i = 0; i < failover->probe_url_count; i++) {
        const char *url = failover->probe_urls[i];

        // Send HTTP HEAD request with timeout
        struct curl_easy *curl = curl_easy_init();
        if (curl == nullptr) {
            continue;
        }

        curl_easy_setopt(curl, CURLOPT_URL, url);
        curl_easy_setopt(curl, CURLOPT_NOBODY, 1L);  // HEAD request
        curl_easy_setopt(curl, CURLOPT_TIMEOUT, failover->probe_timeout_sec);
        curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 0L);  // No redirects

        CURLcode res = curl_easy_perform(curl);
        curl_easy_cleanup(curl);

        if (res == CURLE_OK) {
            return true;  // At least one probe succeeded
        }
    }

    return false;  // All probes failed
}

// C23: Check and update failover state
static void check_split_exclude_failover(
    split_exclude_failover_t *failover,
    split_tunnel_config_t *split_config
) {
    if (!failover->enabled) {
        return;
    }

    time_t now = time(nullptr);
    if (now - failover->last_probe_time < failover->probe_interval_sec) {
        return;  // Not time to probe yet
    }

    failover->last_probe_time = now;

    bool connectivity = probe_external_connectivity(failover);

    if (connectivity) {
        // External connectivity restored
        if (failover->is_failed_over) {
            syslog(LOG_INFO, "Split-exclude failover: External connectivity restored");
            failover->is_failed_over = false;
            // Restore normal split-exclude routing
            restore_split_exclude_routes(split_config);
        }
        failover->consecutive_failures = 0;
    } else {
        // External connectivity failed
        failover->consecutive_failures++;

        if (!failover->is_failed_over &&
            failover->consecutive_failures >= failover->failure_threshold) {
            syslog(LOG_WARNING,
                   "Split-exclude failover: External connectivity lost, "
                   "routing excluded traffic via VPN");
            failover->is_failed_over = true;
            // Route all split-exclude traffic through VPN
            failover_split_exclude_routes(split_config);
        }
    }
}

// Modify split-exclude routes to go through VPN
static void failover_split_exclude_routes(
    split_tunnel_config_t *config
) {
    for (size_t i = 0; i < config->count; i++) {
        split_route_t *route = &config->routes[i];
        if (!route->is_include) {
            // Temporarily convert exclude to include
            route->is_include = true;
            route->priority = 200;  // Lower priority for failover routes
        }
    }
}

// Restore normal split-exclude routing
static void restore_split_exclude_routes(
    split_tunnel_config_t *config
) {
    for (size_t i = 0; i < config->count; i++) {
        split_route_t *route = &config->routes[i];
        if (route->priority == 200) {
            // Restore exclude status
            route->is_include = false;
            route->priority = 0;
        }
    }
}

4. WPA3 SAE Transition (5.1.9.113)

Feature: Support WPA2↔WPA3 transition mode with TDI (Transition Disable Indication).

Implementation (NAM module):

// wolfguard/src/nam/wpa3_sae.c

typedef enum {
    WPA_VERSION_WPA2 = 2,
    WPA_VERSION_WPA3 = 3,
    WPA_VERSION_TRANSITION = 4  // WPA2/WPA3 mixed mode
} wpa_version_t;

typedef struct {
    wpa_version_t version;
    bool sae_enabled;               // WPA3-SAE enabled
    bool transition_disable;        // TDI received
    uint8_t pmkid[16];              // PMKID for fast roaming
    uint8_t pmk[32];                // Pairwise Master Key
} wpa_config_t;

// C23: Handle WPA3 SAE authentication
[[nodiscard]] int wpa3_sae_authenticate(
    const char *ssid,
    const char *passphrase,
    wpa_config_t *config
) {
    if (ssid == nullptr || passphrase == nullptr || config == nullptr) {
        return -EINVAL;
    }

    // WPA3-SAE uses Dragonfly handshake (RFC 7664)
    // This is typically handled by wpa_supplicant, but ocserv
    // needs to configure it properly

    // Generate SAE commit message
    // 1. Password Element (PE) = H2C(password)
    // 2. Scalar and Element for Dragonfly

    // Implementation would interface with wpa_supplicant or
    // nl80211 directly for SAE authentication

    config->sae_enabled = true;
    return 0;
}

// Handle Transition Disable Indication (TDI)
void handle_transition_disable_indication(wpa_config_t *config) {
    if (config == nullptr) {
        return;
    }

    // TDI bit 0: Disable WPA2 Personal
    // TDI bit 1: Disable WPA2 Enterprise
    // When TDI received, client must not reconnect with WPA2

    config->transition_disable = true;
    config->version = WPA_VERSION_WPA3;

    syslog(LOG_INFO,
           "WPA3 SAE: Transition Disable Indication received, "
           "disabling WPA2 for this network");
}

Note: WPA3 SAE is primarily a NAM (Network Access Manager) feature, not core VPN. ocserv would not implement this directly, but documentation is provided for completeness.

5. Certificate Template Filtering (5.1.6.103)

Feature: Filter certificates by Template Name/Information/Identifier.

Implementation:

// wolfguard/src/auth/cert_template.c

#include <gnutls/gnutls.h>
#include <gnutls/x509.h>

typedef struct {
    char template_name[256];        // Template Name
    char template_info[256];        // Template Information
    uint8_t template_oid[64];       // Template OID
    size_t template_oid_len;
} cert_template_filter_t;

// Microsoft Certificate Template Extension OIDs
#define MS_CERT_TEMPLATE_NAME_OID       "1.3.6.1.4.1.311.20.2"
#define MS_CERT_TEMPLATE_INFO_OID       "1.3.6.1.4.1.311.21.7"

// C23: Extract certificate template from X.509 extension
[[nodiscard]] int extract_cert_template(
    gnutls_x509_crt_t cert,
    cert_template_filter_t *template
) {
    if (cert == nullptr || template == nullptr) {
        return -EINVAL;
    }

    memset(template, 0, sizeof(*template));

    // Extract Template Name (Microsoft extension)
    for (unsigned int i = 0; i < 100; i++) {
        char oid[128];
        size_t oid_size = sizeof(oid);
        uint8_t data[1024];
        size_t data_size = sizeof(data);
        unsigned int critical = 0;

        int ret = gnutls_x509_crt_get_extension_info(
            cert, i, oid, &oid_size, &critical
        );

        if (ret < 0) {
            break;  // No more extensions
        }

        // Check if this is the Template Name extension
        if (strcmp(oid, MS_CERT_TEMPLATE_NAME_OID) == 0) {
            ret = gnutls_x509_crt_get_extension_data(
                cert, i, data, &data_size
            );
            if (ret >= 0) {
                // Parse BMPString (UTF-16 encoded name)
                // For simplicity, assume ASCII and skip encoding conversion
                size_t name_len = data_size / 2;  // UTF-16 to char count
                if (name_len &gt; sizeof(template->template_name) - 1) {
                    name_len = sizeof(template->template_name) - 1;
                }
                for (size_t j = 0; j < name_len; j++) {
                    template->template_name[j] = data[j * 2 + 1];
                }
            }
        }

        // Check if this is the Template Information extension
        if (strcmp(oid, MS_CERT_TEMPLATE_INFO_OID) == 0) {
            ret = gnutls_x509_crt_get_extension_data(
                cert, i, data, &data_size
            );
            if (ret >= 0) {
                // Parse SEQUENCE { OID, INTEGER (version) }
                // Store raw OID for matching
                if (data_size &gt; 0 && data_size <= sizeof(template->template_oid)) {
                    memcpy(template->template_oid, data, data_size);
                    template->template_oid_len = data_size;
                }
            }
        }
    }

    return 0;
}

// C23: Match certificate against template filter
[[nodiscard]] bool cert_matches_template_filter(
    gnutls_x509_crt_t cert,
    const cert_template_filter_t *filter
) {
    if (cert == nullptr || filter == nullptr) {
        return false;
    }

    cert_template_filter_t cert_template;
    if (extract_cert_template(cert, &cert_template) < 0) {
        return false;
    }

    // Match Template Name (if specified)
    if (filter->template_name[0] != '\0') {
        if (strcmp(cert_template.template_name, filter->template_name) != 0) {
            return false;
        }
    }

    // Match Template OID (if specified)
    if (filter->template_oid_len &gt; 0) {
        if (cert_template.template_oid_len != filter->template_oid_len) {
            return false;
        }
        if (memcmp(cert_template.template_oid, filter->template_oid,
                   filter->template_oid_len) != 0) {
            return false;
        }
    }

    return true;  // Match successful
}

// Filter certificate list by template
int filter_certs_by_template(
    gnutls_x509_crt_t *certs,
    size_t cert_count,
    const cert_template_filter_t *filter,
    gnutls_x509_crt_t *filtered_certs,
    size_t *filtered_count
) {
    *filtered_count = 0;

    for (size_t i = 0; i < cert_count; i++) {
        if (cert_matches_template_filter(certs[i], filter)) {
            filtered_certs[*filtered_count] = certs[i];
            (*filtered_count)++;
        }
    }

    return 0;
}

Build System Changes

Makefile.am additions:

# New source files for 5.1 features
ocserv_SOURCES += \
    src/vpn/split_tunnel.c \
    src/vpn/split_exclude_failover.c \
    src/crypto/ikev2_ppk.c \
    src/auth/cert_template.c

# New dependencies
ocserv_LDADD += \
    -lcurl \
    $(OPENSSL_LIBS) \
    $(GNUTLS_LIBS)

# Conditional compilation for platform-specific features
if ENABLE_LINUX_ARM64
ocserv_SOURCES += src/platform/linux_arm64.c
endif

if ENABLE_EBPF
ocserv_SOURCES += src/nam/ebpf_loader.c
ocserv_LDADD += -lbpf
endif

configure.ac additions:

# Check for ARM64 platform
AC_ARG_ENABLE([linux-arm64],
    [AS_HELP_STRING([--enable-linux-arm64],
                    [Enable Linux ARM64 support])],
    [enable_linux_arm64=$enableval],
    [enable_linux_arm64=no])
AM_CONDITIONAL([ENABLE_LINUX_ARM64], [test "x$enable_linux_arm64" = "xyes"])

# Check for eBPF support
AC_ARG_ENABLE([ebpf],
    [AS_HELP_STRING([--enable-ebpf],
                    [Enable eBPF support for NVM])],
    [enable_ebpf=$enableval],
    [enable_ebpf=no])
AM_CONDITIONAL([ENABLE_EBPF], [test "x$enable_ebpf" = "xyes"])

if test "x$enable_ebpf" = "xyes"; then
    AC_CHECK_LIB([bpf], [bpf_object__open], [],
                 [AC_MSG_ERROR([libbpf not found])])
fi

# Check for libcurl (split exclude failover probes)
PKG_CHECK_MODULES([LIBCURL], [libcurl >= 7.50.0])

Testing Recommendations

Unit Tests:

// tests/test_split_tunnel.c

#include <assert.h>
#include "vpn/split_tunnel.h"

void test_dynamic_split_tunnel_include_exclude() {
    split_tunnel_config_t config = {0};
    config.dynamic_enabled = true;

    // Add include: 10.0.0.0/8
    add_split_route(&config, "10.0.0.0/8", true);

    // Add exclude: 10.1.0.0/16 (more specific)
    add_split_route(&config, "10.1.0.0/16", false);

    // Test: 10.0.0.1 should tunnel (included)
    assert(route_should_tunnel(&config, 0x0A000001) == true);

    // Test: 10.1.0.1 should NOT tunnel (excluded, more specific)
    assert(route_should_tunnel(&config, 0x0A010001) == false);

    // Test: 192.168.0.1 should NOT tunnel (not in any list)
    assert(route_should_tunnel(&config, 0xC0A80001) == false);

    free_split_tunnel_config(&config);
}

void test_split_exclude_failover() {
    split_exclude_failover_t failover = {
        .enabled = true,
        .probe_interval_sec = 1,
        .probe_timeout_sec = 1,
        .failure_threshold = 2,
        .probe_url_count = 1,
        .is_failed_over = false,
        .consecutive_failures = 0,
        .last_probe_time = 0
    };

    strcpy(failover.probe_urls[0], "http://invalid-domain-that-does-not-exist.com");

    split_tunnel_config_t config = {0};
    add_split_route(&config, "192.168.0.0/16", false);  // Exclude

    // First probe failure
    check_split_exclude_failover(&failover, &config);
    assert(failover.consecutive_failures == 1);
    assert(failover.is_failed_over == false);

    sleep(2);

    // Second probe failure - should trigger failover
    check_split_exclude_failover(&failover, &config);
    assert(failover.consecutive_failures == 2);
    assert(failover.is_failed_over == true);

    // Check that exclude route was converted to include
    assert(config.routes[0].is_include == true);
    assert(config.routes[0].priority == 200);

    free_split_tunnel_config(&config);
}

int main() {
    test_dynamic_split_tunnel_include_exclude();
    test_split_exclude_failover();
    printf("All split tunnel tests passed\n");
    return 0;
}

Integration Tests:

#!/bin/bash
# tests/integration/test_5.1_features.sh

# Test 1: Dynamic split tunneling
echo "Testing dynamic split tunneling..."
ocserv-cli set-split-include 10.0.0.0/8
ocserv-cli set-split-exclude 10.1.0.0/16
ping -c 1 10.0.0.1  # Should go through tunnel
ping -c 1 10.1.0.1  # Should go direct (excluded)

# Test 2: Split exclude failover
echo "Testing split exclude failover..."
ocserv-cli enable-split-exclude-failover
ocserv-cli set-failover-probe http://www.example.com
# Simulate internet outage (block outbound traffic)
iptables -A OUTPUT -d 0.0.0.0/0 -j DROP
sleep 70  # Wait for failover to trigger
# Check that excluded traffic now goes through tunnel
# (implementation-specific verification)
iptables -D OUTPUT -d 0.0.0.0/0 -j DROP

# Test 3: Certificate template filtering
echo "Testing certificate template filtering..."
ocserv-cli set-cert-template-filter "VPN User Template"
# Attempt connection with matching certificate
ocserv-cli connect --cert user_cert.pem
# Should succeed

# Attempt connection with non-matching certificate
ocserv-cli connect --cert admin_cert.pem
# Should fail or not use this certificate

echo "All integration tests completed"

Summary

This document provides a comprehensive comparison between Cisco Secure Client 5.0 and 5.1, highlighting:

88 new features across 12 major releases (5.1.0 - 5.1.12)
6 deprecated features requiring migration
15 critical bug fixes with workarounds
13 security enhancements improving cryptography and network security
Platform support changes across Windows, macOS, and Linux
C23 implementation examples for all major new features

Key Takeaways for ocserv (C23) Implementation:

Dynamic split tunneling requires route priority engine
IKEv2 PPK adds post-quantum crypto to key exchange
Split exclude failover needs external connectivity monitoring
Certificate template filtering requires X.509 extension parsing
Platform-specific features (WPA3, eBPF, ARM64) are modular

Migration Risk Assessment:

LOW RISK: VPN core protocol unchanged, backward compatible
MEDIUM RISK: Platform support changes may affect deployments
HIGH RISK: ZTA certificate renewal (5.1.8.105 → 5.1.8.122 mandatory)

Recommended Upgrade Path:

Verify platform compatibility
Test in lab environment
Upgrade to 5.1.8.122+ (skip 5.1.8.105)
Enable new features incrementally
Monitor for regression issues

End of Document

Table of Contents​

Executive Summary​

Feature Comparison Matrix​

Core VPN Features​

Authentication & Security​

Zero Trust & Visibility​

Platform Support​

Modules & Components​

New Features in 5.1​

5.1.0.136 (July 2023)​

5.1.1.42 (September 2023)​

5.1.2.42 (November 2023)​

5.1.3.62 (January 2024)​

5.1.4.74 (March 2024)​

5.1.5.65 (May 2024)​

5.1.6.103 (June 2024)​

5.1.7.80 (August 2024)​

5.1.8.105 (September 2024)​

5.1.8.122 (September 2024 - Critical)​

5.1.9.113 (October 2024)​

5.1.10.233 (November 2024)​

5.1.11.388 (December 2024)​

5.1.12.146 (January 2025)​

Protocol Changes​

TLS/DTLS Evolution​

X-CSTP Headers​

X-DTLS Headers​

DPD Mechanism Changes​

MTU Handling​

New Protocol: IKEv2 PSK/PPK (5.1.8.105)​

Platform Support Changes​

Windows​

macOS​

Linux​

iOS​

Deprecated Features​

Removed in 5.1​

Changed Behavior in 5.1​

Deprecated in 5.0 (Continued in 5.1)​

Critical Bug Fixes​

Security-Critical (CVE-Level)​

Connectivity-Critical​

Platform-Specific​

ZTA/QUIC Issues (Persistent)​

Protocol-Specific​

macOS-Specific​

Windows-Specific​

Linux-Specific​

Captive Portal​

Security Enhancements​

Cryptographic Improvements​

Network Security​

Identity & Access​

Audit & Compliance​

Migration Considerations​

Upgrading from 5.0 to 5.1​

Pre-Migration Checklist​

Migration Path by Platform​

Post-Migration Validation​

Known Migration Issues​

Rollback Plan​

C23 Implementation Impact​

Code Changes Required for 5.1 Features​

1. Dynamic Split Tunneling (5.1.2.42)​

2. IKEv2 PSK/PPK (5.1.8.105)​

3. Split Exclude Failover (5.1.10.233)​

4. WPA3 SAE Transition (5.1.9.113)​

5. Certificate Template Filtering (5.1.6.103)​

Build System Changes​

Testing Recommendations​

Summary​

Table of Contents

Executive Summary

Feature Comparison Matrix

Core VPN Features

Authentication & Security

Zero Trust & Visibility

Platform Support

Modules & Components

New Features in 5.1

5.1.0.136 (July 2023)

5.1.1.42 (September 2023)

5.1.2.42 (November 2023)

5.1.3.62 (January 2024)

5.1.4.74 (March 2024)

5.1.5.65 (May 2024)

5.1.6.103 (June 2024)

5.1.7.80 (August 2024)

5.1.8.105 (September 2024)

5.1.8.122 (September 2024 - Critical)

5.1.9.113 (October 2024)

5.1.10.233 (November 2024)

5.1.11.388 (December 2024)

5.1.12.146 (January 2025)

Protocol Changes

TLS/DTLS Evolution

X-CSTP Headers

X-DTLS Headers

DPD Mechanism Changes

MTU Handling

New Protocol: IKEv2 PSK/PPK (5.1.8.105)

Platform Support Changes

Windows

macOS

Linux

iOS

Deprecated Features

Removed in 5.1

Changed Behavior in 5.1

Deprecated in 5.0 (Continued in 5.1)

Critical Bug Fixes

Security-Critical (CVE-Level)

Connectivity-Critical

Platform-Specific

ZTA/QUIC Issues (Persistent)

Protocol-Specific

macOS-Specific

Windows-Specific

Linux-Specific

Captive Portal

Security Enhancements

Cryptographic Improvements

Network Security

Identity & Access

Audit & Compliance

Migration Considerations

Upgrading from 5.0 to 5.1

Pre-Migration Checklist

Migration Path by Platform

Post-Migration Validation

Known Migration Issues

Rollback Plan

C23 Implementation Impact

Code Changes Required for 5.1 Features

1. Dynamic Split Tunneling (5.1.2.42)

2. IKEv2 PSK/PPK (5.1.8.105)

3. Split Exclude Failover (5.1.10.233)

4. WPA3 SAE Transition (5.1.9.113)

5. Certificate Template Filtering (5.1.6.103)

Build System Changes

Testing Recommendations

Summary