Installing or Upgrading HostScan
Use this procedure to upload, or upgrade, and enable a new HostScan image on the ASA. Use the image to enable HostScan functionality for AnyConnect or upgrade the HostScan support charts for an existing deployment of Cisco Secure Desktop (CSD).
If you previously uploaded a CSD image to the ASA, the HostScan image you specify will upgrade or downgrade the existing HostScan files that were delivered with that CSD package.
You do not need to restart the ASA after you install or upgrade HostScan; however, you must exit and restart Adaptive Security Device Manager (ASDM) to access the Secure Desktop Manager tool in ASDM.
Note 
HostScan requires an AnyConnect Secure Mobility Client premium license.
HostScan requires an AnyConnect Secure Mobility Client premium license.
Step 1 Download the latest version of the HostScan package using Downloading the HostScan Engine Update.
Download the latest version of the HostScan package using Downloading the HostScan Engine Update.
Note You will need to have an account on Cisco.com and be logged in to download the software.
You will need to have an account on Cisco.com and be logged in to download the software.
Step 2 Open ASDM and choose Configuration > Remote Access VPN > HostScan Image. ASDM opens the HostScan Image panel (Figure 2-1).
Open ASDM and choose Configuration > Remote Access VPN > HostScan Image. ASDM opens the HostScan Image panel (Figure 2-1).
Figure 2-2 HostScan Image Panel
Step 3 Click Upload to prepare to transfer a copy of the HostScan package from your computer to a drive on the ASA.
Click Upload to prepare to transfer a copy of the HostScan package from your computer to a drive on the ASA.
Step 4 In the Upload Image dialog box, click Browse Local Files to search for the HostScan package on your local computer.
In the Upload Image dialog box, click Browse Local Files to search for the HostScan package on your local computer.
Step 5 Select the hostscan_version.pkg file you downloaded in Step 1 and click Select. The path to the file you selected is in the Local File Path field and the Flash File System Path field reflects the destination path of the HostScan package. If your ASA has more than one flash drive, you can edit the Flash File System Path to indicate another flash drive.
Select the hostscan_version.pkg file you downloaded in Step 1 and click Select. The path to the file you selected is in the Local File Path field and the Flash File System Path field reflects the destination path of the HostScan package. If your ASA has more than one flash drive, you can edit the Flash File System Path to indicate another flash drive.
Step 6 Click Upload File. ASDM transfers a copy of the file to the flash card. An Information dialog box displays the following message:
Click Upload File. ASDM transfers a copy of the file to the flash card. An Information dialog box displays the following message:File has been uploaded to flash successfully.
Step 7 Click OK.
Click OK.
Step 8 In the Use Uploaded Image dialog, click OK to use the HostScan package file you just uploaded as the current image.
In the Use Uploaded Image dialog, click OK to use the HostScan package file you just uploaded as the current image.
Step 9 Check Enable HostScan/CSD if it is not already checked.
Check Enable HostScan/CSD if it is not already checked.
Step 10 Click Apply.
Click Apply.
Note If AnyConnect Essentials is enabled on the ASA, you receive a message that HostScan and CSD will not work with it. You have the choice to Disable or Keep AnyConnect Essentials.
If AnyConnect Essentials is enabled on the ASA, you receive a message that HostScan and CSD will not work with it. You have the choice to Disable or Keep AnyConnect Essentials.
Step 11 Click Save.
Click Save.Enabling or Disabling HostScan on the ASA
When you first upload or upgrade a HostScan image using ASDM, you enable the image as part of that procedure. See "Installing and Enabling CSD on the ASA" section.
Otherwise, to enable or disable a HostScan image using ASDM, follow this procedure:
Step 1 Open ASDM and choose Configuration > Remote Access VPN > HostScan Image. ASDM opens the HostScan Image panel (Figure 2-1).
Open ASDM and choose Configuration > Remote Access VPN > HostScan Image. ASDM opens the HostScan Image panel (Figure 2-1).
Step 2 Check Enable HostScan/CSD to enable HostScan or uncheck Enable HostScan/CSD to disable HostScan.
Check Enable HostScan/CSD to enable HostScan or uncheck Enable HostScan/CSD to disable HostScan.
Step 3 Click Apply.
Click Apply.
Step 4 Click Save.
Click Save.Uninstalling the HostScan Package from the ASA
Uninstalling the HostScan package removes it from view on the ASDM interface and prevents the ASA from deploying it even if HostScan or CSD is enabled. Uninstalling HostScan does not delete the HostScan package from the flash drive.
Use this procedure to uninstall HostScan on the ASA:
Step 1 Open ASDM and select Configuration > Remote Access VPN > HostScan Image.
Open ASDM and select Configuration > Remote Access VPN > HostScan Image.
Step 2 In the HostScan Image pane, click Uninstall. ASDM removes the text from the Location text box.
In the HostScan Image pane, click Uninstall. ASDM removes the text from the Location text box.
Step 3 Click Save.
Click Save.HostScan and CSD Automatic Upgrades and Downgrades
The ASA automatically distributes the enabled HostScan package to the endpoint whether that package is the standalone HostScan package, the package included with AnyConnect Secure Mobility Client, or the package included with Cisco Secure Desktop. If the endpoint has an older version of the HostScan package installed, the package on the endpoint gets upgraded; if the endpoint has a newer version of the HostScan package, the endpoint package gets downgraded.
Which HostScan Image Gets Enabled When There is More than One Loaded on the ASA?
The HostScan image is delivered with the HostScan package. It can be deployed to the endpoint from the standalone HostScan package, the full AnyConnect Secure Mobility Client package, and Cisco Secure Desktop. Depending on what licenses you have installed on your ASA, you may have all of these packages loaded on your ASA. In that case, the ASA enables the image that you specified as the HostScan image first and if you haven't specified one, the ASA enables the HostScan functionality from Cisco Secure Desktop. See the"Installing, Upgrading, and Downgrading CSD on the ASA" section.
If you uninstall the HostScan package, the ASA cannot enable its HostScan image.
These scenarios describe which HostScan package the ASA distributes when it has more than one loaded.
•If you have installed a standalone HostScan package on the ASA and have designated it as the HostScan image, and you enable CSD/hostscan, ASA distributes the standalone HostScan package.
If you have installed a standalone HostScan package on the ASA and have designated it as the HostScan image, and you enable CSD/hostscan, ASA distributes the standalone HostScan package.
•If you have installed a standalone HostScan package on the ASA and have designated it as the HostScan image and you have installed a CSD image on the ASA, and you enable CSD/hostscan, ASA will distribute the standalone HostScan image.
If you have installed a standalone HostScan package on the ASA and have designated it as the HostScan image and you have installed a CSD image on the ASA, and you enable CSD/hostscan, ASA will distribute the standalone HostScan image.
•If you have installed a HostScan image on the ASA, but you have not enabled it, and you have installed a CSD image on the ASA and you have enabled CSD/hostscan, the ASA will distribute the standalone HostScan image because it was not uninstalled.
If you have installed a HostScan image on the ASA, but you have not enabled it, and you have installed a CSD image on the ASA and you have enabled CSD/hostscan, the ASA will distribute the standalone HostScan image because it was not uninstalled.
•If you have installed an AnyConnect Secure Mobility Client package on the ASA and have designated it as the HostScan image, the ASA will distribute the HostScan image from that package.
If you have installed an AnyConnect Secure Mobility Client package on the ASA and have designated it as the HostScan image, the ASA will distribute the HostScan image from that package.
•If you install an AnyConnect Secure Mobility Client package file on the ASA but do not specify it as the HostScan image, the ASA will not distribute the HostScan package associated with that AnyConnect package. The ASA will distribute an installed HostScan package or CSD package, provided CSD is enabled.
If you install an AnyConnect Secure Mobility Client package file on the ASA but do not specify it as the HostScan image, the ASA will not distribute the HostScan package associated with that AnyConnect package. The ASA will distribute an installed HostScan package or CSD package, provided CSD is enabled.Determining the HostScan Image Enabled on the ASA
Open ASDM and select Configuration > Remote Access VPN > Host Scan Image.
If there is a HostScan image designated in the HostScan Image location field, and the Enable HostScan/CSD box is checked, the version of that image is the HostScan version being used by the ASA.
If the HostScan Image filed is empty, and the Enable HostScan/CSD box is checked, select Configuration > Remote Access VPN > Secure Desktop Manager. The version of CSD in the Secure Desktop Image Location field is the HostScan version being used by the ASA.
