What's New
3 min
- Post-Quantum Cryptography (PQC) Support: Administrators can enable PQC to use quantum-resistant key exchange mechanisms and enhanced encryption algorithms, helping protect connections against future quantum-computing threats while enforcing the required security settings automatically, see Post-Quantum CryptographyPost-Quantum Cryptography.
- Authentication Service Fallback: Added support for Authentication Service Fallback, which automatically redirects authentication requests to an alternate Sign-in Realm configuration when the primary authentication service (LDAP or AD) is unavailable, see Auth service FallbackAuth service Fallback.
- Windows Hello for Business (WHFB SSO) Authentication Fallback: ICS now supports Windows Hello for Business (WHFB SSO) Authentication Fallback, providing a seamless alternative authentication path as SAML/OAuth server when WHFB SSO cannot be completed successfully, see FallBack Authentication ServerFallback sever.
- Enhanced HTTP/2 Support: Connect Secure has been enhanced to support HTTP/2 for egress client connections for rewriter usecase. HTTP/2 provides improved connection efficiency and performance through multiplexing and optimized protocol handling, see HTTP Protocol Configuration.
- RSA Authentication Manager 8.8: Support for RSA Authentication Manager 8.8 is qualified as part of the validation for ICS 25.x. For RSA Authentication Manager 8.8 and newer versions, Ivanti recommends using the new RSA (REST API) authentication server, see see Using a RSA Server (REST API)RSA (REST API) authentication server and APIsAPIs.
- RSA Authentication Manager 8.8: Support for RSA Authentication Manager 8.8 is qualified as part of the validation for ICS 25.x. As a result, users who have upgraded to RSA Authentication Manager 8.8 will be able to use this functionality with ICS 25.1.3.1. For RSA Authentication Manager 8.8 and newer versions, Ivanti recommends using the new RSA (REST API) authentication server, see Using a RSA Server (REST API)RSA (REST API) authentication server
- Automated Certificate Management Environment (ACME) Support: ICS now supports the Automated Certificate Management Environment (ACME) protocol, enabling automated certificate enrollment, renewal, and lifecycle management. This reduces administrative overhead associated with certificate maintenance and helps simplify certificate operations, see ACME Server.
- OAuth Group Claims for Role Mapping: Ivanti Connect Secure (ICS) now supports role mapping based on group claims received from OAuth providers such as Microsoft Entra ID (Azure AD). Administrators can use group information included in the OAuth ID Token or UserInfo response to assign user roles within ICS user realms, see OAuth Group Claims Role Mapping.
- Windows Hello for Business (WHfB) Single Sign-On Enhancements: This release includes enhancements to Windows Hello for Business (WHfB) Single Sign-On functionality, providing improved integration with modern authentication workflows and passwordless authentication deployments, see Windows Hello for Business SSO Server.
- FIDO2 Authentication Enhancements: ICS has been enhanced to support FIDO2-related authentication improvements, enabling support for modern passwordless authentication methods and strengthening identity security, see FIDO2 support for mobile ISAC .
- HTTP/2 Ingress Support in NGINX: NGINX has been enhanced to support HTTP/2 for inbound client connections. HTTP/2 provides improved connection efficiency and performance through multiplexing and optimized protocol handling, see HTTP Protocol Configuration.
- Health Check Diagnostic Logs: A new Health Check Diagnostic Logging capability has been added to improve visibility into system health monitoring operations. Administrators can use these logs to assist troubleshooting and operational diagnostics, see Rest API Diagnostic Logs and Healthcheck Diagnostic Logs.
- Default VLAN ID Support with IPv6 on Internal Interfaces: Ivanti Connect Secure now supports the use of the Default VLAN ID when IPv6 is configured on the Internal Interface. This enhancement ensures that the Default VLAN ID remains available and functional when both IPv4 and IPv6 are enabled, see Default VLAN ID.
- Host Header Validation: Ivanti Connect Secure now provides a console-based option to disable Host Header Validation on the management interface, see Host Header Validation.
- Rest API Diagnostic Logs: A new Rest API Diagnostic Logging capability has been added to improve visibility into system health monitoring operations. Administrators can use these logs to assist troubleshooting and operational diagnostics, see Rest API Diagnostic Logs.
- Configurable Certificate Challenge Timeout: Administrators can now configure the maximum interval between certificate challenge exchanges during the pre-authentication phase of certificate-based authentication. The timeout value can be set from 1 to 4 minutes, with a default value of 1 minute, see Certificate Challenge Timeout.
- DSIDID Enforcement for Secure VPN Authentication: DSIDID enforcement ensures secure VPN authentication by verifying both DSID and DSIDID cookies. This provides an additional layer of device and session validation, enhancing overall security, see Configuring Miscellaneous Security Options.
- Proxy Servers for PSAM Connections: ICS now supports Proxy Server for connections to PSAM destination (TCP only) via Proxy Servers. Administrators can modify existing policies to route traffic through proxy servers, enhancing both security and scalability, see Proxy Servers for PSAM Connection.
- Source IP and Geo-Location access restriction: Allow administrators to configure and enable both Geo-Location and manual IP lists simultaneously.This enhancement improve ICS security by allowing customers to better restrict access from bad actors while permitting legitimate traffic, see ../../../22.7R2.11/ics_adminguide/Content/general_access_management.htm#general_access_management_28561674_1012043Specifying Source IP Restrictions at the Realm Level
- FallBack Authentication Server: ICS now supports configuring authentication fallback options within any user realm. Currently, the available fallback option is TOTP (Time-Based One-Time Password). This means if the primary authentication methods such as certificate, LDAP, or Active Directory fails, users can use TOTP as a backup method, see ../../../22.7R2.11/ics_adminguide/Content/auth_realms.htm#SelectFallBack Authentication Server.
- Samsung Knox Manage: This feature enhances security by ensuring that only authorized android devices are permitted access based on validated device identifiers, see Configuring an MDM Server.
- Rotate Internal Storage Key:This process encrypts sensitive information like passwords when storing them internally and ensures the encryption key is unique and random for every ICS instance, see Rotate Internal Storage Key.
- Security Enhanced WAF Operation: This feature protects Connect Secure gateway web applications by filtering and monitoring HTTP traffic, preventing attacks such as SQL injection, cross-site scripting (XSS), and other web exploits, see Configuring Web Application Firewall UI and Security Enhanced WAF Operation console.
- Shared Secret key: This feature configures a Shared Secret for each source/target pair at time of creation of Push Config Target, see Configuring Targets.
- Password key Generation: New API's introduced to generate and fetch the password key, see APIs.
- Next Generation Web server: The Next Generation Web Server has been developed to enhance the performance and scalability of web server infrastructure, see Next Generation Web Server. Web server logs are implemented for web-related event codes with debug severity, see Using the Debug Log.
- SELinux Security Policy: The ICS system provides an Enforcing only SELinux capability, ensuring that even the root user or admin cannot switch SELinux to permissive mode without rebooting the system, See SELinux Security Policy.
- Verbose Log: Administrators can toggle SELinux verbose logging to control the detail level of SELinux-related logs, see SELinux Verbose Log.