solution https://community.cisco.com/t5/cisco-software-discussions/do-i-need-https-secure-gateway-for-ipsec-tunnel/td-p/3708077

Welcome!  Now I try to push AnyConnect profile config to the client by captive portal on my ISR.      

Hi! I have this problem too I change AnyConnectLocalPolicy.xml and check "Bypass downloader" (if you change it by text editor, just change false to true) <BypassDownloader>true</BypassDownloader>   Best Regards