Hello,Yes, you can run WPA&CCKM at the same time (mandatory) and encryption is TKIP.As for the authentication, you are use either Leap with WPA&CCKM , Leap with WPA or Leap with CCKM.ThanksTony

Hi, You are right. You can not assign ip address to VPDN client from RADIUS or TACACS server suck as ACS server.ThanksTony

Hi Michele, What you said is right. When you are doing IOS IPSEC stateful failover, the remote site has no idea you are doing failover and it can support more equipment. Anyway, you are correct about VPN 3K and IOS IPSEC.ThanksTony

Hi, If you have FWSM on the switch, the fixup protocol is enable by default which has the same function as inspection for CBAC on router.ThanksTony

Hi , You probably want to upload the config for further troubleshoot.Tony