Thanks! This gives me a good picture of what needs to be in place.

Ok. That's helpful.So as long as the ASA trusts the CA and the cert is valid, authentication will pass (if it's certificate-only auth)?In addition to MobileIron, are there any other solutions/vendors doing this? I don't work with the client side much...

Glad to see this post. We're attempting to set up certificate based authentication for certain iPad VPN clients for the purpose of enabling the AnyConnect connect-on-demand feature. I do have a further question. The only documentation I seem to be ab...