Upgrading Ivanti Secure Access Client

12 min

Introduction

After a desktop/mobile client device is enrolled on Ivanti Neurons for Zero Trust Access (nZTA), the following upgrade operations are supported:

A client update package can be downloaded to each enrolled device to add new features and to resolve issues in previous versions. See Working with Client Packages.

An Endpoint Security Assessment Plug-In (ESAP) update can be downloaded to each enrolled device. An ESAP package is included in every system software package. However, Ivanti releases ESAP update packages more frequently than system software versions. You may choose to upgrade the ESAP package more regularly than client software. See Enabling Minimum Supported Client Version.

All packages are automatically uploaded to the Controller. No manual intervention is required to achieve this. You can choose to either the latest updates to be automatically made available to your end-user client devices, or to manually control the roll out of a selected package version.

When you select a newly-available update package for your end-users, or where you have elected to enable automatic updates and a new version becomes available, allow up to 30 minutes before the new package download is triggered on your end user client devices.

Working with Client Packages

After a client device is enrolled, you can upgrade its client software with a newer Ivanti Secure Access Client package from the Controller.

To upgrade Ivanti Secure Access Client automatically, see Upgrading Ivanti Secure Access Client Automatically.

Automatic client upgrades are not currently supported on Ivanti Secure Access Client Linux variants.

To enable manual upgrade of Ivanti Secure Access Client, see Enabling Manual Update of Ivanti Secure Access Client.

Client upgrade packages are automatically uploaded to the Controller. No manual intervention is required to achieve this.

Upgrading Ivanti Secure Access Client Automatically

Automatic client upgrades are not currently supported on Ivanti Secure Access Client Linux variants.

To upgrade all Ivanti Secure Access Client to the latest client package automatically:

Log into the Controller as a Tenant Admin, see Logging in as a Tenant Administrator.

From the nZTA menu, click the Administration icon, then select Upgrade > Installation Packages. The Installation Packages page appears.

Click the Ivanti Secure Access Client tab. A list of available Ivanti Secure Access Client packages appears. The list contains ISAC packages common to ZTA and ICS , and ISAC packages specific to ZTA. The list does not show ICS specific client packages.

Enable the Auto update to latest version control.

The most recent Ivanti Secure Access Client package is selected automatically. For example:

Automatic Ivanti Secure Access Client Update

As each user next logs into Ivanti Secure Access Client on their device, if their software is at an earlier version than the latest version in the Controller, Ivanti Secure Access Client provides an automatic update to the selected version.

Enabling Manual Update of Ivanti Secure Access Client

To enable users to manually update to a specified version of Ivanti Secure Access Client:

Log into the Controller as a Tenant Admin, see Logging in as a Tenant Administrator.

From the nZTA menu, click the Administration icon, then select Upgrade > Installation Packages. The Installation Packages page appears.

Click the Ivanti Secure Access Client tab. A list of available Ivanti Secure Access Client packages appears. The list contains ISAC packages common to ZTA and ICS , and ISAC packages specific to ZTA.

Disable the Auto update to latest version control.

Select any of the listed Ivanti Secure Access Client packages. This is the version of the Ivanti Secure Access Client software that you want users to have on their device. For example:

Manual Ivanti Secure Access Client Update

As each user next logs into Ivanti Secure Access Client on their device, if their software is at a different version, Ivanti Secure Access Client provides a prompt to the user to change to the version you selected in the Controller.

Ivanti Secure Access Client for Desktops does not support a downgrade path. If the version you select in the Controller is earlier than the client version currently installed on a user's desktop device, the user must first uninstall the current Ivanti Secure Access Client software. To trigger installation of the required version, the user must then re-perform the nZTA enrollment procedure through a web browser.

Enabling Minimum Supported Client Version

This feature provides an option for the admin to force upgrade the client version when Minimum Client Version is configured.

To enable this feature:

Log into the Controller as a Tenant Admin, see Logging in as a Tenant Administrator.

From the nZTA menu, click the Administration icon, then select Upgrade > Installations.

Enforce Minimum Client Version

Select the Enforce minimum client version check box.

The following options appear.

Desktop

Android

If Force update is selected, Client will auto-upgrade once you enroll with older client.

Specify the minimum client version to be enforced on Ivanti Secure Access Client. For example, 22.3R1. If the minimum client version is not specified for any specific type of client, any version of the client is allowed to connect to Ivanti Connect Secure without any minimum client version enforcement for that specific client.

Click Save.

Working with ESAP Packages

ESAP (Endpoint Security Assessment Plug-in) is a Ivanti Secure Access Client plug-in through which you can upload the latest security assessment definitions independently of a full client software upgrade. After a user device is enrolled and Ivanti Secure Access Client has been installed, you can upgrade ESAP with newer versions from the Controller.

To update ESAP definitions on Ivanti Secure Access Client automatically, see Updating ESAP Definitions on Clients Automatically.

To enable the manual update of ESAP definitions on Ivanti Secure Access Client, see Enabling Manual Update of ESAP Definitions on Clients.

ESAP upgrade packages are automatically uploaded to the Controller. When each user next logs into Ivanti Secure Access Client on their device, if their ESAP definition is at an earlier version, the ESAP definition updates automatically from the most recent ESAP package.

Updating ESAP Definitions on Clients Automatically

To view all available ESAP packages:

Log into the Controller as a Tenant Admin, see Logging in as a Tenant Administrator.

From the nZTA menu, click the Administration icon, then select Upgrade > ESAP. A list of available ESAP packages appears.

To review Release Notes of an ESAP package, click on the icon in the Release Note column. The PDF version of the Release Note will be downloaded and will appear in a new tab.

This feature is disabled by default. When each user logs into Ivanti Secure Access Client on their device, if their ESAP definition is at an earlier version, the ESAP definition updates automatically from the most recent ESAP package.

Enabling Manual Update of ESAP Definitions on Clients

To activate an ESAP package:

Log into the Controller as a Tenant Admin, see Logging in as a Tenant Administrator.

From the nZTA menu, click the Administration icon, then select Upgrade > ESAP.

A list of available ESAP packages appears.

Click Activate corresponding to the ESAP version that you want to upgrade.

The Status of the selected package changes to Queued. The upgrade process might take about 30 minutes.

The existing version remains active till the new version is successfully activated.

Once the new version is active, the Status of the new package changes to Active, and the old version changes to Inactive.

Release Notes

To review Release Notes of an ESAP package, click on the icon in the Release Note column. The PDF version of the Release Note will be downloaded and will appear in a new tab.

Migration of Failed Device Policy Rules

If the activation fails due to unsupported product in the device policy, the Status changes to In Progress and the Action column shows Pending Action link.

Click the Pending Action link. In the Pending Action page displayed, review the device policy changes and click Confirm.

The failed product(s) is removed, and the package is activated.

In scenario where there is only one product defined in the device policy, and that is not supported in the new ESAP version, then update fails and you need to update the device policy manually and then click Re-run evaluation.