The two general VPN categories supported by Cisco ASA are further divided into the following VPN technologies. SSL Based VPNs are also called WebVPN in Cisco terminology. The first category uses the IPSec protocol for secure communications while the second category uses SSL. The current Anyconnect client is 4.3 but I'm working on upgrading.Cisco supports several types of VPN implementations on the ASA but they are generally categorized as either “ IPSec Based VPNs” or “ SSL Based VPNs“. My end goal is to have the dynamic IPSEC tunnel working alongside of An圜onnect, without having to manually touch the remote Anyconnect machines. Is moving to SSL as simple as removing IPSEC from the Group Policy? Do I need to worry about orphaned profiles on remote machines? I don't have admin access to a couple of my machines so I can't remove the locally stored profiles. Currently I've disabled the new dynamic IPSEC connection because An圜onnect access is more important. I believe if I move from IPSEC to SSL for my Anyconnect setup I can eliminate this profile issue (feel free to tell me I'm wrong). If I go in and manually delete the local connection profile on the laptops, Anyconnect begins working again on some machines but not all. I can get this new tunnel up but when I do, An圜onnect stops working for some of my machines. I've recently tried to setup a IPSEC tunnel from a site with a dynamic ip address. I have an ASA 5515 currently setup with IPSEC for Anyconnect access. If an end user needs to establish an IKEv2 IPsec connection, they will need udp/500, udp/4500 (may not always be required) and protocol 50 (ESP) allowed from the remote network. One down side and something that may be part of your clients' issues is that many remote networks restrict the protocols that are permitted to egress their networks to a few widely-used ones like http and https (tcp/80 and 443). However, advances in browser and server-side support allow us to use these methods with SSL VPN as well. Initially some cited IKEv2 as 'more secure' as it has built-in support for stronger encryption algorithms like AES-256-GCM and integrity assurance mechanisms like SHA2-384.

Not knowing the specifics of your head end setup and your users' problems, it's hard to say definitively that SSL VPN would fix them.Īs I mentioned back when this thread started, the only reasons I have ever seen cited for adopting IKEv2-based IPsec remote access VPN is because there is some legal or regulatory requirement that mandates the organization must do so.

Cisco anyconnect vs ipsec vpn client