Anyconnect and preshared keys

[waltrich]

Is it possible to use the anyconnect client and still use preshared keys?  I'm trying to remediate a PCI issue that requires removing IKEv1, and preshared key, and disabling aggressive mode.

Will any of this break Anyconnect?  Your assistance in appreciated!

[David Johan Castro Fernandez]

Hi,

It is completely possible, You can disable the aggressive mode from the ASA and it will not affect the AnyConnect beacuse it uses (TLS and DTLS protocols)which is completely different from the IPSec.

Now you can disable the aggressive mode as follow:

hostname(config)# crypto ikev1 am-disable

If you have VPN clients IPSec, they will work with main mode if you use certificate authentication only, not using pre-shared keys.

Please don't forget to rate and Mark as correct the helpful Post!

David Castro,

Regards,