Looks like Cisco's AnyConnect 4.0 may be using TLS 1.2 now too for EAP, although I have not validated this: "AnyConnect 4.0 Win/Mac/Linux available for Plus/Apex customers. ISE 1.3 Compliance, TLS 1.2, and more." https://twitter.com/AnyConnect/status/532178489911574529