Upgrading Ivanti Secure Access Client

Introduction

After a desktop/mobile client device is enrolled on Ivanti Neurons for Zero Trust Access (nZTA), the following upgrade operations are supported:

  • A client update package can be downloaded to each enrolled device to add new features and to resolve issues in previous versions. See Working with Client Packages.

  • An Endpoint Security Assessment Plug-In (ESAP) update can be downloaded to each enrolled device. An ESAP package is included in every system software package. However, Ivanti releases ESAP update packages more frequently than system software versions. You may choose to upgrade the ESAP package more regularly than client software. See Enabling Minimum Supported Client Version.

All packages are automatically uploaded to the Controller. No manual intervention is required to achieve this. You can choose to either the latest updates to be automatically made available to your end-user client devices, or to manually control the roll out of a selected package version.

Note

When you select a newly-available update package for your end-users, or where you have elected to enable automatic updates and a new version becomes available, allow up to 30 minutes before the new package download is triggered on your end user client devices.

Working with Client Packages

After a client device is enrolled, you can upgrade its client software with a newer Ivanti Secure Access Client package from the Controller.

Client upgrade packages are automatically uploaded to the Controller. No manual intervention is required to achieve this.

Upgrading Ivanti Secure Access Client Automatically

Note

Automatic client upgrades are not currently supported on Ivanti Secure Access Client Linux variants.

To upgrade all Ivanti Secure Access Client to the latest client package automatically:

  1. Log into the Controller as a Tenant Admin, see Logging in as a Tenant Administrator.

  2. From the nZTA menu, click the Administration icon, then select Upgrade > Installation Packages.

    The Installation Packages page appears.

  3. Click the Ivanti Secure Access Client tab.

    A list of available Ivanti Secure Access Client packages appears.

  4. Enable the Auto update to latest version control.

    The most recent Ivanti Secure Access Client package is selected automatically. For example:

    autoclientupdate

    FIGURE 268 Automatic Ivanti Secure Access Client Update

As each user next logs into Ivanti Secure Access Client on their device, if their software is at an earlier version than the latest version in the Controller, Ivanti Secure Access Client provides an automatic update to the selected version.

Enabling Manual Upgrade of Ivanti Secure Access Client

To enable users to manually update to a specified version of Ivanti Secure Access Client:

  1. Log into the Controller as a Tenant Admin, see Logging in as a Tenant Administrator.

  2. From the nZTA menu, click the Administration icon, then select Upgrade > Installation Packages.

    The Installation Packages page appears.

  3. Click the Ivanti Secure Access Client tab.

    A list of available Ivanti Secure Access Client packages appears.

  4. Disable the Auto update to latest version control.

  5. Select any of the listed Ivanti Secure Access Client packages. This is the version of the Ivanti Secure Access Client software that you want users to have on their device. For example:

    manclientupdate

    FIGURE 269 Manual Ivanti Secure Access Client Update

As each user next logs into Ivanti Secure Access Client on their device, if their software is at a different version, Ivanti Secure Access Client provides a prompt to the user to change to the version you selected in the Controller.

Note

Ivanti Secure Access Client for Desktops does not support a downgrade path. If the version you select in the Controller is earlier than the client version currently installed on a user’s desktop device, the user must first uninstall the current Ivanti Secure Access Client software. To trigger installation of the required version, the user must then re-perform the nZTA enrollment procedure through a web browser.

Enabling Minimum Supported Client Version

This feature provides an option for the admin to force upgrade the client version when Minimum Client Version is configured.

To enable this feature:

  1. Log into the Controller as a Tenant Admin, see Logging in as a Tenant Administrator.

  2. From the nZTA menu, click the Administration icon, then select Upgrade > Installations.

    autoclientupdate

    FIGURE 270 Enforce Minimum Client Version

  3. Select the Enforce minimum client version check box.

    The following options appear.

    • Desktop

    • Android

    • iOS

    Note

    If Force update is selected, Client will auto-upgrade once you enroll with older client.

  4. Specify the minimum client version to be enforced on Ivanti Secure Access Client. For example, 22.3R1.

    If the minimum client version is not specified for any specific type of client, any version of the client is allowed to connect to Ivanti Connect Secure without any minimum client version enforcement for that specific client.

  5. Click Save.

Working with ESAP Packages

ESAP (Endpoint Security Assessment Plug-in) is a Ivanti Secure Access Client plug-in through which you can upload the latest security assessment definitions independently of a full client software upgrade. After a user device is enrolled and Ivanti Secure Access Client has been installed, you can upgrade ESAP with newer versions from the Controller.

Note

ESAP upgrade packages are automatically uploaded to the Controller. When each user next logs into Ivanti Secure Access Client on their device, if their ESAP definition is at an earlier version, the ESAP definition updates automatically from the most recent ESAP package.

Updating ESAP Definitions on Clients Automatically

To view all available ESAP packages:

  1. Log into the Controller as a Tenant Admin, see Logging in as a Tenant Administrator.

  2. From the nZTA menu, click the Administration icon, then select Upgrade > Installation Packages.

    The Installation Packages page appears.

  3. Click the ESAP tab.

    A list of available ESAP packages appears.

Note

This feature is permanently enabled. When each user logs into Ivanti Secure Access Client on their device, if their ESAP definition is at an earlier version, the ESAP definition updates automatically from the most recent ESAP package.

Enabling Manual Update of ESAP Definitions on Clients

Note

This feature is not currently supported.