Clientless SSL VPN Is Gone: WebVPN on the Modern ASA

If you are studying an older CCIE or CCNP security blueprint, or working from a tutorial written a few years ago, you will find pages of material on Clientless SSL VPN (WebVPN) on the Cisco ASA: browser-based portals, bookmarks, port forwarding, plug-ins, smart tunnels. Here is the thing nobody tells you until you try it on a current box: on modern ASA software that feature is gone. Not deprecated-but-present, not hidden behind a license, actually removed from the command parser. This article proves it with real CLI output from an ASAv running 9.24(1), explains exactly when and why it happened, and shows what replaced it. It is part of the PingLabz Cisco ASA series.

The short version: Cisco deprecated Clientless SSL VPN effective ASA 9.17(1), and by 9.24(1) the clientless-specific commands are removed. If you are about to spend hours learning bookmark lists and port-forward configs, stop and read this first. You would be studying a dead feature.

What Clientless SSL VPN Was

Clientless SSL VPN, also called WebVPN, let a remote user reach internal resources through a web browser with no VPN client installed. They browsed to the ASA's portal over HTTPS, authenticated, and got a page of bookmarks: internal web apps, file shares, and, through port forwarding and smart tunnels, even some thick-client applications proxied through the browser. It was genuinely useful in the era of locked-down corporate desktops and kiosk access, because it required nothing on the endpoint but a browser.

It also carried real baggage. Rewriting arbitrary internal web apps to work through a proxy portal was fragile and broke constantly as web apps grew more complex, the Java and ActiveX components it leaned on became security liabilities, and the whole model aged badly against modern web technology. That combination is why Cisco drew a line under it.

The Proof: vpn-tunnel-protocol No Longer Offers Clientless

Talk is cheap, so let the box speak. A group policy on the ASA declares which VPN protocols its users may use with vpn-tunnel-protocol. On older code, the option list for that command included an ssl-clientless keyword. Ask the 9.24(1) parser what it accepts now.

FW1(config-group-policy)# vpn-tunnel-protocol ?
group-policy mode commands/options:
  ikev1       IKE version 1
  ikev2       IKE version 2
  l2tp-ipsec  L2TP using IPSec for security
  ssl-client  SSL VPN Client

Read that list carefully. There are exactly four options: ikev1, ikev2, l2tp-ipsec, and ssl-client. The ssl-client entry is the full-client Secure Client (AnyConnect) tunnel, which is very much alive. What is missing is ssl-clientless. It used to be right there in this list, and on 9.24(1) it simply is not offered any more. The parser will not even suggest it.

Try to set it anyway, spelling out what used to be a valid keyword, and the ASA rejects it.

FW1(config-group-policy)# vpn-tunnel-protocol ssl-clientless
ERROR: % Incomplete command

"% Incomplete command" is the parser telling you the token ssl-clientless is not recognized as a valid completion, so the line reads as unfinished. This is not a licensing message or a "feature disabled" notice. The keyword is gone from the grammar.

The Clientless Feature Commands Are Removed Too

It is not just the protocol keyword. The commands that configured clientless features, the ones every old tutorial walks you through, are removed from the WebVPN configuration mode as well. Two of the most recognizable are port forwarding and bookmark lists.

FW1(config-webvpn)# port-forward PLZ-PF 3389 10.20.10.100 3389
                        ^
ERROR: % Invalid input detected at '^' marker.
FW1(config-webvpn)# bookmark-list
                       ^
ERROR: % Invalid input detected at '^' marker.

The caret sits right under the command word. "% Invalid input detected at '^' marker" means the parser did not recognize the command at that position at all. port-forward, which used to proxy a TCP application (here RDP on 3389) through the clientless portal, and bookmark-list, which built the menu of links the portal presented, are both simply not commands the 9.24(1) ASA understands. Every clientless-specific building block is in the same state.

But the webvpn Container Still Exists

One subtlety trips people up here, and the captures show it. Notice that the prompt above is FW1(config-webvpn)#. The webvpn configuration mode still exists. You can still enter it. So did they only half-remove the feature?

No. The webvpn container survives because Secure Client (the client formerly known as AnyConnect) uses it. The full-client SSL VPN and its download images, profiles, and settings live under webvpn, so the mode has to stay. What is gone is the clientless-specific subset: the portal, bookmarks, port forwarding, smart tunnels, and the ssl-clientless protocol option. The container remains for the living feature; the dead feature's commands were pulled out of it. That is why you can enter config-webvpn but cannot type bookmark-list once you are there.

The Timeline: 9.17 Out, 9.24 Confirmed

The dates matter, because they determine whether your box is affected. Cisco announced deprecation of Clientless SSL VPN effective ASA software release 9.17(1). Deprecation is the warning shot: the feature is on notice and you should stop deploying it. Removal followed, and by the 9.24(1) release running in this lab the clientless commands are gone from the parser, exactly as the output above proves. If you are on a release at or beyond 9.17, treat clientless as end-of-life; if you are already on 9.18 or later, expect it to be absent.

This is also why chasing a walkthrough of the feature is a poor use of study time in 2026. The exam blueprints and the shipping software have both moved. Understanding that clientless was removed, when, and what took its place is the current, testable knowledge. A step-by-step of how to build a bookmark list is knowledge of a feature you cannot configure on a supported box.

What Replaced It: Secure Client Remote Access

The replacement is full-client remote-access VPN with Cisco Secure Client (the product's name since the AnyConnect rebrand). Instead of proxying resources through a browser portal, the user runs a lightweight client that builds a real tunnel to the ASA, and their traffic reaches internal resources natively. It is more capable, more secure, and it does not depend on the fragile web-rewriting that sank the clientless model. PingLabz already covers both flavors of it end to end:

Secure Client SSL VPN

Transport: TLS/DTLS (the ssl-client protocol)

Use when: you want the classic full-client SSL RA-VPN

Secure Client IKEv2 VPN

Transport: IPsec/IKEv2 (the ikev2 protocol)

Use when: you want IPsec-based remote access

Notice that both replacements map directly to keywords that are still in that vpn-tunnel-protocol list: ssl-client and ikev2. The ASA did not lose remote-access VPN, it lost the browser-portal style of it. If your remote users still need to reach a handful of internal web apps without a client at all, that use case now belongs to a reverse proxy or a Zero Trust Network Access (ZTNA) product, not to the ASA. For the IPsec fundamentals underneath the IKEv2 option, the IPsec VPN hub is the place to start.

Migration Checklist for a Pre-9.17 Box

If you are still running clientless SSL VPN on an older ASA, here is the path off it before an upgrade removes the feature under you.

Inventory what clientless is actually doing. List every bookmark, port-forward, and smart-tunnel entry and map it to the real resource behind it. You are cataloguing what users reach, not the config.
Sort each resource by replacement. Full network access goes to Secure Client SSL or IKEv2 RA-VPN. Web-app-only access with no client goes to a reverse proxy or ZTNA. Thick-client-over-browser (port forwarding) almost always becomes full-client access.
Stand up Secure Client RA-VPN in parallel. Build the SSL or IKEv2 remote-access profile alongside the running clientless config so you can pilot before cutover.
Migrate users in waves, then decommission. Move groups over, confirm they can reach their resources through the client, and only then remove the clientless configuration.
Do not upgrade past 9.17 with a live dependency. If clientless is still load-bearing, complete the migration before you cross the version boundary that deletes the commands, or the upgrade will break access.

Common Questions

Is AnyConnect also gone?

No, and this is the most common confusion. AnyConnect was rebranded to Cisco Secure Client, but the full-client SSL and IKEv2 remote-access VPN it provides is alive and is the recommended replacement. Only the clientless, browser-portal style of SSL VPN was removed. The ssl-client keyword still in the vpn-tunnel-protocol list is exactly that living full-client feature.

Can I still reach internal web apps without installing a client?

Not through the ASA. That specific use case, browser-only access to internal web applications, is what clientless served, and it now belongs to a reverse proxy or a Zero Trust Network Access (ZTNA) product. The ASA's job is network-layer remote access via Secure Client.

How do I know if my ASA still has clientless?

Check your software version and ask the parser. If you are below 9.17, clientless is likely present but deprecated. On 9.17 and later, run vpn-tunnel-protocol ? in group-policy mode: if the list shows only ikev1, ikev2, l2tp-ipsec, and ssl-client, clientless is gone, exactly as on the 9.24(1) box here.

Why did Cisco remove it instead of just leaving it?

Clientless relied on rewriting arbitrary internal web applications to run through a portal proxy, plus Java and ActiveX components. That model became increasingly fragile and a security liability as web technology evolved. Rather than carry a brittle, hard-to-secure feature indefinitely, Cisco deprecated it in 9.17 and moved customers to the full-client and ZTNA models that handle modern access more safely.

Key Takeaways

Clientless SSL VPN (WebVPN) is removed: Cisco deprecated it effective ASA 9.17(1), and on the 9.24(1) box in this lab the clientless commands are gone from the parser.
The CLI proves it: vpn-tunnel-protocol ? lists only ikev1, ikev2, l2tp-ipsec, and ssl-client (no ssl-clientless); vpn-tunnel-protocol ssl-clientless returns "% Incomplete command"; and port-forward and bookmark-list return "% Invalid input."
The webvpn container survives: Secure Client (AnyConnect) still uses it, so you can enter config-webvpn, but the clientless-specific commands were pulled out of it.
The replacement is full-client RA-VPN: Secure Client over SSL (ssl-client) or IKEv2 (ikev2), both of which PingLabz covers. Client-less web-app access now belongs to a reverse proxy or ZTNA.
If you are pre-9.17, migrate before you upgrade: inventory the clientless resources, map each to its replacement, pilot Secure Client in parallel, and decommission clientless before crossing the version that removes it.

Keep going: the Cisco ASA pillar indexes every ASA lab on PingLabz, and the two Secure Client remote-access guides, SSL and IKEv2, are the modern replacements for everything clientless used to do.

Clientless SSL VPN Is Gone: What Replaced WebVPN on Modern ASA