Arch Linux User Repository

After package installation, vpnagentd service must be enabled: sudo systemctl enable --now vpnagentd.service; sudo systemctl status vpnagentd.service

Webkit2gtk is required to log in using single sign on (SSO) such as when you sign on with a Microsoft account such as the one you use for your email at your employer.

If you get an error message such as you are missing the required libraries for the authentication method you requested, and you log into the vpn with your email account provided by your employer, you will need to install this package

Installing webkit2gtk normally requires compilation and depending on the number of cores your processor has, this may take a long time. To avoid the time it takes to compile, use webkit2gtk-4.1 instead https://archlinux.org/packages/extra/x86_64/webkit2gtk-4.1/

If you don't use vanilla arch nor endeavouros you will not be able to accessing non secured routes like Google and you will need to install webkit2gtk

i solved the non secured route issue by doing this, i gave gemini the url of a cachyos forum post and solved it:

Solution 2: Prevent NetworkManager from Managing the Cisco Interface (Permanent Fix) To prevent NetworkManager from ever trying to manage the Cisco Secure Client virtual interface in the future, you can explicitly set it to be unmanaged.

Open or create a NetworkManager configuration file using your preferred text editor (e.g., nano or micro):

sudo nano /etc/NetworkManager/conf.d/99-cisco-unmanage.conf

Paste the following configuration blocks inside the file:

[keyfile]

unmanaged-devices=interface-name:cscotun*

(eliminate the empty lime between [keyfile] and unmanaged-devices)

Save the file and exit (Ctrl+O, Enter, then Ctrl+X in nano).

Restart the NetworkManager service to apply changes:

sudo systemctl restart NetworkManager.service

sudo systemctl restart vpnagentd.service

Although I still don't recommend installing it on arch based distros like cachy os or even arch itself. The vpn connects then hangs bash and fish processes. I was trying to run opencode to run end to end tests with playwright fixing them automatically and the bash tool calls for playwright and find would just hang after around 5 minutes. If it doesn't hang, there's a lot of productivity to be gained on linux because the workflow was like batch jobs: run a set of tests then fix those that fail, on a ralph loop with oh my openagent

@dmsh Looks good, thanks.

@alllexx88 - Updated to 5.1.17.3394, please verify and confirm.

Current latest version: https://archive.org/download/cisco-secure-client-linux64-5.1.17.3394/cisco-secure-client-linux64-5.1.17.3394-predeploy-deb-k9.tgz

Updated to 5.1.16.194, thanks to @alllexx88 for provided PKGBUILD.

Switching to a .deb package actually simplifies things. This works for me:

# Note: After installation must me enabled service 'sudo systemctl enable --now vpnagentd.service'
pkgname=cisco-secure-client
pkgver=5.1.16.194
pkgrel=1
pkgdesc='Cisco AnyConnect Secure Mobility Client'
url='https://www.cisco.com/site/us/en/products/security/secure-client/index.html'
arch=('x86_64')
depends=('libxml2-legacy' 'ca-certificates')
optdepends=(
    'hicolor-icon-theme: required by desktop shortcuts'
    'glib2: required by vpnui'
    'gtk3: required by vpnui'
    'webkit2gtk: required by acwebhelper'
)
conflicts=('cisco-anyconnect')
license=('custom')

# skip stripping the binaries to pass integrity check inside vpnagentd
options=('!strip')

source=(
    "https://git.ufz.de/howto/linux/vpn-setup/-/raw/update_5.1.16.194/cisco-secure-client-linux64-${pkgver}-predeploy-deb-k9.tgz"
)

sha256sums=('9b5d6b731a88f84b0c50da7d4d8afc9da6d874fc54504701ef5a49b321d03aa3')

prepare() {
    cd "$srcdir"
    bsdtar -xf "cisco-secure-client-vpn_${pkgver}_amd64.deb"
}

package() {
    if [ -f "$srcdir"/data.tar.zst ]; then
        bsdtar -xf "$srcdir"/data.tar.zst -C "$pkgdir/"
    else
        bsdtar -xf "$srcdir"/data.tar.xz -C "$pkgdir/"
    fi

    mv -f "$pkgdir/lib" "$pkgdir/usr"
}

Presumably to update this, you'd need to edit the PKGBUILD to use one of the other releases as a basis for it? Perhaps the rpm version? I am not familiar enough with PKGBUILD to try myself.

I've had an issue in the vpnagentd - the UI said "cannot set up routing tables", and the log started with "Unable to get interface index for IP address <ip>", where cscotun0 had a different IP than what was there in the logs.

Turns out, NetworkManager decided to start owning the connection. I did nmcli connection delete cscotun0 and it got solved.

Looking at the latest Cisco secure client download page https://software.cisco.com/download/home/286330811/type/282364313/release/5.1.16.194 there seem to be no cisco-secure-client-linux64-5.1.16.194-predeploy-k9.tgz -- the only linux64 predeploy being cisco-secure-client-linux64-5.1.16.194-predeploy-deb-k9.tgz and cisco-secure-client-linux64-5.1.16.194-predeploy-rpm-k9.tgz

It means we need to update PKGBUILD to repackage from one of these if we want to upgrade beyond 5.1.14.145, and they're both available on https://git.ufz.de/howto/linux/vpn-setup/-/tree/update_5.1.16.194

@dmsh I've updated to 5.1.14.145. Seems working.