I need to implement two types of Anyconnect. One has to be IPSec based, AAA authentication for users and certificate based authentication in tunnel (IKEv2). Second has to be SSL (tunnel mode), certificate based user authentication (user and machine certificate), and also certificate based authentication in tunnel (IKEv2). Certificates can be self-signed. Can anyone paste me cli configuration or point to some manual for my requirements?

  • It's the VPN head end (concentrator) device that you will be configuring, therefore we would need to know what make and model that device is. Jan 25, 2017 at 19:45
  • Headend is ASA 5508-X, Software Version 9.6(1)
    – John
    Jan 26, 2017 at 7:50
  • Did the answer help you? If so, you should accept it so that the question doesn't keep popping up forever, looking for an answer.
    – Ron Maupin
    Jul 24, 2017 at 19:16
  • Main configuration is ok, but additional questions are not answered.
    – John
    Jul 24, 2017 at 19:20

1 Answer 1


Please find below configuration for both cases from AnyConnect over IKEv2 to ASA with AAA and Certificate Authentication:

Configuration on the ASA

This section describes the ASA configurations that are required before the connection occurs.

Note: The Cisco Adaptive Security Device Manager (ASDM) allows you to create the basic configuration with only a few clicks. Cisco recommends that you use it in order to avoid mistakes.

Crypto Map Configuration

Here is a crypto map example configuration:

crypto dynamic-map DYN 1 set pfs group1
crypto dynamic-map DYN 1 set ikev2 ipsec-proposal secure
crypto dynamic-map DYN 1 set reverse-route
crypto map STATIC 65535 ipsec-isakmp dynamic DYN
crypto map STATIC interface outside

IPsec Proposals

Here is an IPsec proposal example configuration:

crypto ipsec ikev2 ipsec-proposal secure
 protocol esp encryption aes 3des
 protocol esp integrity sha-1
crypto ipsec ikev2 ipsec-proposal AES256-SHA
 protocol esp encryption aes-256
 protocol esp integrity sha-1

IKEv2 Policies

Here is an IKEv2 policy example configuration:

crypto ikev2 policy 1
 encryption aes-256
 integrity sha
 group 5 2
 prf sha
 lifetime seconds 86400
crypto ikev2 policy 10
 encryption aes-192
 integrity sha
 group 5 2
 prf sha
 lifetime seconds 86400
crypto ikev2 policy 20
 encryption aes
 integrity sha
 group 5 2
 prf sha
 lifetime seconds 86400
crypto ikev2 policy 30
 encryption 3des
 integrity sha
 group 5 2
 prf sha
 lifetime seconds 86400
crypto ikev2 policy 40
 encryption des
 integrity sha
 group 5 2
 prf sha
 lifetime seconds 86400

Client Services and Certificate

You must enable client services and certificates on the correct interface, which is the outside interface in this case. Here is an example configuration:

crypto ikev2 enable outside client-services port 443
crypto ikev2 remote-access trustpoint OUTSIDE
ssl trust-point OUTSIDE outside

Note: The same trustpoint is also assigned for Secure Sockets Layer (SSL), which is intended and required.

Enable AnyConnect Profile

You must enable the AnyConnect profile on the ASA. Here is an example configuration:

 enable outside
 anyconnect image disk0:/anyconnect-win-3.0.5080-k9.pkg 1 regex "Windows NT"
 anyconnect profiles Anyconnect disk0:/anyconnect.xml
 anyconnect enable
 tunnel-group-list enable

Username, Group-Policy, and Tunnel-Group

Here is an example configuration for a basic username, group-policy, and tunnel-group on the ASA:

group-policy GroupPolicy_AC internal
group-policy GroupPolicy_AC attributes
 dns-server value
 vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec ssl-client ssl-clientless
 default-domain value cisco.com
  anyconnect profiles value Anyconnect type user
username cisco password 3USUcOPFUiMCO4Jk encrypted privilege 15
tunnel-group AC type remote-access
tunnel-group AC general-attributes
 address-pool VPN-POOL
 default-group-policy GroupPolicy_AC
tunnel-group AC webvpn-attributes
 authentication aaa certificate
 group-alias AC enable
 group-url https://bsns-asa5520-1.cisco.com/AC enable

AnyConnect Profile

Here is an example profile with the relevant parts shown in bold:

<?xml version="1.0" encoding="UTF-8"?>
<AnyConnectProfile xmlns="http://schemas.xmlsoap.org/encoding/"
 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation=
 "http://schemas.xmlsoap.org/encoding/ AnyConnectProfile.xsd">
    <UseStartBeforeLogon UserControllable="true">false</UseStartBeforeLogon>
    <AutomaticCertSelection UserControllable="true">false
    <AutoConnectOnStart UserControllable="true">false</AutoConnectOnStart>
    <MinimizeOnConnect UserControllable="true">true</MinimizeOnConnect>
    <LocalLanAccess UserControllable="true">false</LocalLanAccess>
    <ClearSmartcardPin UserControllable="true">true</ClearSmartcardPin>
    <AutoReconnect UserControllable="false">true
       <AutoReconnectBehavior UserControllable="false">DisconnectOnSuspend 
    <AutoUpdate UserControllable="false">true</AutoUpdate>
    <RSASecurIDIntegration UserControllable="true">Automatic
    <PPPExclusion UserControllable="false">Disable
       <PPPExclusionServerIP UserControllable="false"></PPPExclusionServerIP>
    <EnableScripting UserControllable="false">false</EnableScripting>
    <EnableAutomaticServerSelection UserControllable="false">false

Here are some important notes about this configuration example:

  • When you create the profile, the HostAddress must match the Certificate Name (CN) on the certificate that is used for IKEv2.
    Enter the crypto ikev2 remote-access trustpoint command in order to define this.
  • The UserGroup must match the name of the tunnelgroup to which the IKEv2 connection falls. If they do not match, the connection often
    fails and the debugs indicate a Diffie-Hellman (DH) group mismatch or a similar false negative.

Verification on ASA

Enter this command on the ASA in order to verify that the connection uses IKEv2 as well as AAA and certificate authentication:

bsns-asa5520-1# show vpn-sessiondb detail anyconnect filter name cisco

Session Type: AnyConnect Detailed
Username : cisco Index : 6
Assigned IP : Public IP :
Protocol : IKEv2 IPsecOverNatT AnyConnect-Parent
License : AnyConnect Premium
Encryption : AES256 AES128 Hashing : none SHA1 SHA1
Bytes Tx : 0 Bytes Rx : 960
Pkts Tx : 0 Pkts Rx : 10
Pkts Tx Drop : 0 Pkts Rx Drop : 0
Group Policy : GroupPolicy_AC Tunnel Group : AC
Login Time : 15:45:41 UTC Tue Aug 28 2012
Duration : 0h:02m:41s
Inactivity : 0h:00m:00s
NAC Result : Unknown
VLAN Mapping : N/A VLAN : none
IKEv2 Tunnels: 1
IPsecOverNatT Tunnels: 1
AnyConnect-Parent Tunnels: 1
 Tunnel ID : 6.1
 Public IP :
 Encryption : none Auth Mode : Certificate and userPassword
 Idle Time Out: 30 Minutes Idle TO Left : 27 Minutes
 Client Type : AnyConnect
 Client Ver : 3.0.08057
 Tunnel ID : 6.2
 UDP Src Port : 60468 UDP Dst Port : 4500
Rem Auth Mode: Certificate and userPassword
 Loc Auth Mode: rsaCertificate
 Encryption : AES256 Hashing : SHA1
 Rekey Int (T): 86400 Seconds Rekey Left(T): 86238 Seconds
 PRF : SHA1 D/H Group : 5
 Filter Name :
 Client OS : Windows
 Tunnel ID : 6.3
 Local Addr :
 Remote Addr :
 Encryption : AES128 Hashing : SHA1\
 Encapsulation: Tunnel
 Rekey Int (T): 28800 Seconds Rekey Left(T): 28638 Seconds
 Rekey Int (D): 4608000 K-Bytes Rekey Left(D): 4608000 K-Bytes
 Idle Time Out: 30 Minutes Idle TO Left : 27 Minutes
 Bytes Tx : 0 Bytes Rx : 960
 Pkts Tx : 0 Pkts Rx : 10
  • 1
    Link-only answers are discouraged here, since the answer isn't usable once the link or its content changes. Please consider adding more details to your answer./
    – Teun Vink
    Jan 25, 2017 at 12:23
  • Ok , this configuration looks complete. I just have few more questions. 1. Can certificate for IKEv2 and SSL be self-signed? (because the limitations from this link cisco.com/c/en/us/support/docs/security/… ) 2. When configuring server list..."user group" "must match the name of the tunnel group"..is that the name of Connection profile? 3. While configuring group policy, we have command "anyconnect profiles value Anyconnect type user" ... what does this type stands for "user"..somewhere I see "vpn" there?
    – John
    Jan 26, 2017 at 12:30
  • 4. When configuring Tunnel group, for IPSec we have command: "group-url bsns-asa5520-1.cisco.com/AC enable" ...Does the user enters this URL (bsns-asa5520-1.cisco.com/AC) in browser when he want to connect for the first time and download AnyConnect, as to start web-launch? 5. Does user have to have priviledge 15?
    – John
    Jan 26, 2017 at 12:56
  • Anyone has answers to my questions?
    – John
    Jan 28, 2017 at 0:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.