This documentation assumes your Cisco Firepower 2130 ASA is running 9.13.x code to support Appliance mode. I'm not going to go into details on how to do this..
- We are also assuming that under your "AnyConnect Connection Profiles" section you enabled "Allow user to select connection profile on the login page" is checked and you're using a custom connection profile for AnyConnect users.
NOTE: This is important since a custom profile for AnyConnect will make sure your users are not using the "DefaultRAGroup" for connetions.
NOTE2: 3rd party VPN clients such as the MS Windows 10 VPN client will be using the "DefaultRAGroup" for the connection. You have to make sure no other IPSec/AnyConnect clients will be connecting to this group. We are going to modify this for MS clients use only.
- We are assuming you rolled out Machine certs from a local CA. Also make sure your machine certs have a subject name field or else the connection will fail as the ASA uses the SN for tracking who connected. Without a Subject field you won't be able to connect.
- We are assuming you are using MS VPN Client for Windows 10 that supports IKEv2 w/PFS
- We are assuming most work is done in ASDM
