AnyConnect AlwaysOn not working

[bvj197222]

I have configured AnyConnect with machine certification authentication and everything works nicely. I can log on and is authenticated as expected. Now I want to enable 'always on'. The config is as enclosed. After enabling the 'automatic VPN policy' and 'always on' options the vpn-client reports 'it may be necessary to connect via a proxy, which is not supported with Always on' (see error 1). As a consequence I also get the error 'anyconnect cannot confirm it is connected to your seucre gateway..' . See the encl log from the client.

The log says 'no valid certificate', but I have a public certificate on the ASA and the machine authentication using certificate was also working before enabling 'always on'. What am I missing out here?

[Marius Gunnerud · Accepted solution]

In the group policy have you enabled "use anyconnect profile setting" ?

[bvj197222]

Thank you Marius, looks like it did the trick. I found one more error, in 'AnyConnect Client Profile' > 'Server List'; The host address used the public IP, so the client reported a certificate error with ('x.x.x.x not matching test.domain.com). I changed it so that both hostname and host address was test.domain.com and everything worked as expected.