PC在互联网上，PC通过防火墙ASA下载anyconnect3.1,下载通过anyconnect拨号后发现，仅支持本地用户名和密码拨号IKEV2，不支持通过LDAP拨号；
配置：
int g0
ip address 192.168.1.1 255.255.255.0
nameif Inside
no shut
int g1
ip address 202.16.1.1 255.255.255.252
nameif Outside
no shut
!
access-list icmp extended peremit icmp any any
access-list icmp extended permit udp any any
access-group icmp in interface Outside
object network LAN
sub 172.16.1.0 255.255.255.0
nat (Inside,Outside) dy inter
object network Remote
sub 10.144.1.0 255.255.255.0
!
nat (Inside,outside) source static LAN LAN destination static Remote Remote
!
ip local pool ezvpn 10.144.1.11-10.144.1.20
!
domain-name test.org
clock timezone GMT +8
ntp server 192.168.1.2
crypto ca trust-point CA
enrollment url
http://202.16.1.2:80 sub-name cn=asa.test.org
fqdn asa.test.org
crypto ca authe CA
crypto ca enroll CA
!
http server enable 500
http 0 0 outside
!
webvpn
enable outside
anyconnect image disk0:/anyconnect-win-3.1.14018-k9.pkg
anyconnect enable
anyconnect profiles group1 disk0:/group1.xml
group-policy group1-certenroll internal
group-policy group1-certenroll attributes
vpn-tunnel-protocol ssl-client
split-tunnel-policy tunnelspecified
split-tunnel-network-list value Split
address-pools value ezvpn
webvpn
anyconnect profiles value group1 type user
!
username cisco password cisco
username cisco attribute
vpn-tunnel-group group1-certenroll
!
ssl trust-point CA
crypto ikev2 enable outside
crypto ikev2 remote-access trust-point CA
crypto ikev2 policy 1
group 2
integrity sha
lifetime 43200
prf sha
crypto ipsec ikev2 ipsec-proposal FirstSet
protocol esp encryption 3des aes
crypto dynamic-map dyn1 1 set ikev2 ipsec-proposal FirstSet
crypto dynamic-map dyn1 1 set reverse-route
crypto map mymap 1 ipsec-isakmp dynamic dyn1
crypto map mymap interface outside
!
tunnel-group test type remote-access
tunnel-group test gen
authentication-server-group ldap LOCAL
!
ldap attribute-map group-to-policy
map-name memberOf IETF-Radius-Class
map-value memberOf CN=group1,OU=Depart1,DC=test,DC=org
aaa-server 2008 (Inside) host 10.1.1.1
ldap-attribute-map group-to-policy
ldap-base-dn dc=test, dc=org
ldap-scope subtree
ldap-naming-attribute sAMAccountName
ldap-login-password 1a.cisco
ldap-login-dn cn=administrator, cn=users, dc=test, dc=org group1-certenroll
server-type microsoft
