Cisco
Login
Search
Software Secure Firewall Threat Defense
Platform Secure Firewall Threat Defense Virtual
Activity Onboard

Objects and Certificates Object Management VPN Secure Client Custom Attributes Objects Add Secure Client Custom Attributes Objects

Last updated: Jul 29, 2025

Add Secure Client Custom Attributes Objects

Before you begin

Ensure that you have done the following before adding a custom attribute object for Per App VPN:

  • Per App VPN must be properly configured via MDM and each device must be enrolled to the MDM server

  • Create a base64 encoded string for each app using the Cisco Secure Client Enterprise Application Selector Tool.

    1. Download the Cisco Secure Client Enterprise Application Selector Tool from here.

    2. Open the Application Selection Tool and select the mobile platform from the drop-down menu located on the upper left.

    3. Add rule by entering Friendly name and App ID; rest of the fields are optional.

    4. On the menu bar, click on Policy. The encoded base65 rule is displayed in its encoded format.

    5. Select and copy the policy string, and save it to use later when you create the Secure Client Custom Attributes object.

Procedure

1

Choose Objects > Object Management > VPN > Custom Attribute.
2

Click Secure Client Custom Attribute.
3

Enter a Name and optionally a Description for the attribute.

4

Select an attribute from the Secure Client Attribute drop-down list:

  • Per App VPN — Select this option and specify the base64 encoded string in the Attribute Value box.

  • Allow Defer Update—Select one of the following options and specify the required information to allow or defer Secure Client update:

    • Show the prompt until user takes action—Display the prompt to the VPN user until the user chooses to allow or defer the VPN client update.

    • Show the prompt until times out—Choose this option to display the prompt for a specified duration and specify the duration int the Timeout box.

    • Do not show the prompt and take automatic action—Choose this option to automatically allow or defer the VPN update.

    • Default Action—Select the default action to be taken when the user does not respond, or when you want to configure an automatic action without the user's intervention. You can choose to update the Secure Client or postpone the update.

    • Minimum Version—Specify the minimum Secure Client version to be present on the client system to allow or defer the update.

  • Dynamic Split Tunneling—Select this option to include or exclude IP addresses or networks from the VPN tunnel.

    • Include domains—Specify domain names that will be included in the remote access VPN tunnel.

    • Exclude domains—Specify domain names that will be excluded from the remote access VPN tunnel.
5

Select the Allow Overrides check box to allow object overrides.
6

Click Save.

The custom attributes object is added to the list.

What to do next

Associate the custom attributes with a group policy. See Add Custom Attributes to a Group Policy .
Previous topic Secure Client Custom Attributes Objects Next topic Add Custom Attributes to a Group Policy