--- title: Introduction slug: ps/help/en_us/ics/22x/22_8r2_4/rn/introduction docTags: createdAt: 2026-08-03T05:25:33.262Z --- Ivanti Connect Secure (ICS) is a next generation Secure access product, which offers fast and secure connection between remote users and their organization’s wider network. Ivanti Connect Secure modernizes VPN deployments and is loaded with features such as new end user experience, increased overall throughput and simplified appliance management. # Noteworthy Information :::hint{type="success"} With Next Generation Web Server enabled, pushconfig from older releases (using legacy web server) to 22.8Rx is not supported. ::: :::ExpandableHeading ## 22.8R2.5 - This release version includes security enhancement. Ivanti encourages customers to upgrade to this latest version. ::: :::ExpandableHeading ## 22.8R2.4 - As part of Citrix’s transition from file-based to cloud-based licensing, this release will support Citrix 2507 LTSR versions. - This release version includes security enhancement. Ivanti encourages customers to upgrade to this latest version. ::: :::ExpandableHeading ## 22.8R2.2 - Outbound HTTP/HTTPS proxy connections are restricted to a defined allow list of well-known proxy ports to align with Secure by Default. **Allowed ports**: 8080, 8118, 8123, 10001–10010, 10080, 3130, 3445, 8008, 8010, 3128. - Starting with ICS version 22.8R2.2 the default global (**System > Configuration > Client configuration**) and Role level (**User > User Roles > \ > VPN tunnelling > Ivanti Secure Access Client Settings**) options for the ISAC Desktop user experience (UX) is set to NeUX for fresh installations of ICS. - Ensure your environment allows installation and execution of the React Native Appx bundle used by NeUX. - Follow the guidance in the [forum](https://hub.ivanti.com/s/article/Unable-to-Switch-UI-Mode-in-Windows-Ivanti-Secure-Access-Client-ISAC?language=en_US) article to enable the Appx bundle. - Applies to: New installations to ICS 22.8R2.2 and later. - **Secondary SessionID verification enforcement for Secure VPN Authentication**: Secondary SessionID verification enforcement ensures ICS server to strictly validate HTTP Only Device Cookie on all L3 and L4 workflows. This provides an additional layer of session validation, enhancing overall security, see [Configuring Miscellaneous Security Options](https://help.ivanti.com/ps/help/en_US/ICS/22.x/22.8R2.2/ag/network_n_host_admin.htm#Enforce). - Feature parity with ICS release [22.7R2.11](https://help.ivanti.com/ps/help/en_US/ICS/22.x/22.7R2.11/rn/whatsnew.htm) - The Next Generation Web Server (Nginx) will restart when performing any of the following certificate-related operations. User connections may drop during this period: - Mapping a device certificate to a port. - Importing or deleting a trusted client CA. - Making changes to inbound TLS versions and cipher suites. - The planned deprecation of the Ivanti Secure Access Client (ISAC) Classic UI has been moved out to allow customers additional time to plan for the transition. For the latest timeline and guidance, see the [KB](https://hub.ivanti.com/s/article/Deprecation-of-Classic-User-Interface-UI-for-Ivanti-Secure-Access-Client-ISAC-for-Desktop-and-Mobile?language=en_US) article. ::: :::ExpandableHeading ## 22.8R2.1 - Feature parity with ICS release [22.7R2.10](https://help.ivanti.com/ps/help/en_US/ICS/22.x/22.7R2.10/rn/landingpage.htm) and [22.7R2.9](https://help.ivanti.com/ps/help/en_US/ICS/22.x/22.7R2.9/rn/landingpage.htm). - After a node joins the cluster, it may take up to 60 seconds for the correct VIP owner to be reflected. This delay ensures accuracy in cluster state reporting. - The External ICT package introduced with the ICS 22.8R2.1 release is not compatible with previous versions of ICS, due to changes made for SELinux inclusion. New releases after 22.8R2.1 will remain compatible with 22.8R2.1, but cannot be used with older ICS versions. For more info refer [KB](https://forums.ivanti.com/s/article/External-ICT-Version-Guidance-for-devices-running-on-22-8R2-1). - The option to disable Web Application Firewall (WAF) and the Next Generation Web Server (Nginx) has been removed. WAF will now run continuously on ICS, ensuring protection. For more info refer [KB](https://forums.ivanti.com/s/article/22-8R2-1-and-above-Information-regarding-NGINX-WAF-and-SE-Linux). - Upgrading from 22.8R2 to 22.8R2.1 on hardware appliances ensures that the factory reset partition is updated along with the active partition. For more information, see [KB](https://forums.ivanti.com/s/article/Factory-Reset-May-Fail-on-Ivanti-Connect-Secure-Hardware-Appliances-Running-22-8R2?language=en_US). - A secure-by-default configuration change is introduced to enable the host header validations on fresh deployment/upgrade in this release. To ensure successful hostname-based requests, administrators must provision certificates with appropriate Subject Alternative Name (SAN) entries matching all intended host header values. - This release includes important security enhancements as part of our ongoing commitment to secure-by-design. Ivanti encourages customers to upgrade to this latest version. - Added validation checks to verify the file-type in /api/v1/system/maintenance/upgrade, when passing the file to the API. Modify your scripts to include the file-type as ‘application/octet-stream’. Code snippet for python provided by Postman App. ```python import requests url = "https:///api/v1/system/maintenance/upgrade" payload = {} files=[ ('file',('package.pkg',open('/C:/Users/qa1/Downloads/','rb'),'application/octet-stream')) ] headers = { 'Authorization': '••••••' } response = requests.request("POST", url, headers=headers, data=payload, files=files) print(response.text) ``` ::: ::::ExpandableHeading ## 22.8R2 - To enable TLS 1.3 functionality, ensure that the enable\_tls\_v1\_3 Key Value Pair is configured and pushed to ISAC mobile client (Android/iOS) from the MDM server. **Key-Value Pair Setting** :::Paragraph{listStyleType="disc" indent="2"} **Configuration Key**: enable\_tls\_v1\_3 ::: :::Paragraph{listStyleType="disc" indent="2"} **Value Type**: Boolean ::: :::Paragraph{listStyleType="disc" indent="2"} **Configuration Value**: true ::: - Security hardening features are not supported on IPS. - The checkbox under the option **Booting Options on Integrity Check Failure** at **System > Configuration > Security > Miscellaneous** becomes irrelevant. Boot time integrity checks performed by SecureBoot will stop the system booting if failure is detected. - Enable **Prevent System Overload** to proactively protect your Connect Secure infrastructure from heavy load or resource spikes. This is a best practice for mission-critical or high-utilization VPN environments. :::: # Unsupported Features - Admin Access via External Interface is no longer supported in Ivanti Connect Secure (ICS) from Version 22.7R2.9, refer to [article](https://forums.ivanti.com/s/article/Admin-Access-via-External-Interface-No-Longer-Supported-in-Ivanti-Connect-Secure-ICS-from-Version-22-7R2-9). - Ivanti Connect Secure: Features and Options Becoming Unsupported or Deprecated in 22.7Rx, 22.8Rx, and 25.x, refer to [article](https://forums.ivanti.com/s/article/Ivanti-Connect-Secure-Features-and-Options-Becoming-Unsupported-or-Deprecated-in-22-7Rx-22-8Rx-and-25-x). - Deprecation of TDI Fail-Over Option for Pulse SAM Connection, refer to [article](https://forums.ivanti.com/s/article/Deprecation-of-TDI-Fail-Over-Option-for-Pulse-SAM-Connection). ## Licenses An ICS instance running version 22.8R2.3 can be configured as a License Server and is qualified to lease licences to 22.8Rx and 25.x instances acting as license clients. While an ICS instance running version 22.7Rx may technically be able to lease license to 22.8Rx or 25.x clients, this configuration has not been qualified. Therefore, it is recommended to use ICS version 22.8R2.3 or later when configuring a license server. # Caveats - Active Directory (AD) 2025 and above will not be supported on 22.8R2 releases due to incompatibility issues with Samba versions. For AD 2025 support, upgrading to release 25.x is required.