Hi Ahmad Saad4, You do need to get an Apex or Plus license to support what you need in regards the clientless connections, you can take a look to the following ordering guide and also the faq, if you have further questions will be better if you contact your Sales Rep: Ordering guide: https://www.cisco.com/c/dam/en/us/products/collateral/security/anyconnect-og.pdf AnyConnect faq: https://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/200191-AnyConnect-Licensing-Frequently-Asked-Qu.html Hope this info helps!! Rate if helps you!! -JP- ... View more

Chris,   At this point is not a matter of license, so you only need to go to cisco.com and download the right version of IOS:    That's just an example you can look for the same Universal image but for the same version you are currently running.   Hope this info helps!!   Rate if helps you!!    -JP-  ... View more

chrishey6489,    Can you add a show version? If i am not mistaking looks like you have a NPE (non payload encryption) image on your Router meaning you are not going to have that type crypto capabilities.   Hope this info helps!!   Rate if helps you!!    -JP-  ... View more

Hi j kay18041,   Considering the release notes of ASA 9.10 seems like this is not supported on some specific hardware: DTLS 1.2 support for AnyConnect VPN remote access connections. DTLS 1.2, as defined in RFC- 6347, is now supported for AnyConnect remote access in addition to the currently supported DTLS 1.0 (1.1 version number is not used for DTLS.) This applies to all ASA models except the 5506-X, 5508-X, and 5516-X; and applies when the ASA is acting as a server only, not a client. DTLS 1.2 supports additional ciphers, as well as all current TLS/DTLS cyphers, and a larger cookie size.   https://www.cisco.com/c/en/us/td/docs/security/asa/asa910/release/notes/asarn910.html#id_25471   Hope this info helps!!   Rate if helps you!!    -JP-  ... View more

Hi  becfip,     Checking the config of the ASA and also the Zyxel i found the following:   -The interesting traffic need to be mirrored between the 2 devices: ASA= any to <destination> Zyxel= <local> to any   If after matching the config you still get any issue you can run the following debugs through the CLI:   debug cry condition peer <zyxelpublicip> debug cry isa 180   You can share the sanitized logs here.   Hope this info helps!!   Rate if helps you!!    -JP-    ... View more

Hi  dbuckley77,   In order to get response from the interface at the other end of the tunnel (ASA) you need to add the following command:   management-access inside   Hope this info helps!!   Rate if helps you!!    -JP-  ... View more

Hi  Richard Lucht,   The reconnections could happen for multiple reasons, you can take a look to the following guide: https://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/116881-technote-anyconnect-00.html   Considering you are describing a more constant reconnection that the one in the guide you need to get a DART so you can get a better idea of the issue: https://community.cisco.com/t5/security-documents/how-to-collect-the-dart-bundle-for-anyconnect/ta-p/3156025   I will also recommend you to check the following FAQ: https://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/116312-qanda-anyconnect-00.html   Considering the DART includes a lot of information that should not be shared publicly i will recommend you to open a case with TAC.   Hope this info helps!!   Rate if helps you!!    -JP-  ... View more

lkovar, If you are concerned about the local database of the ASA this is going to continue working only as local DB without affecting or causing any issue, in regards the CA being a Windows Server you only need to make sure the CA is installed on the ASA and each of your users gets the certificate to authenticate, considering you are going to work with a pair of ASAs in failover please make sure you do write standby on the ASA so the certificates are going to be replicated between the Active and Standby ASA. Hope this info helps!! Rate if helps you!! -JP- ... View more

Hi gautamanish, The config you are sharing looks fine, can you share also the ASA config so we can confirm everything is matching? Hope this info helps!! Rate if helps you!! -JP- ... View more