Can we run AnyConnect using self signed certificates?

[jimmyc_2]

I have a lab that I want to build a laptop-to-ASA remote access tunnel, using AnyConnect.  

I understand AnyConnect requires IKEV2, and certificates.  

It does not allow for pre-shared passwords, like VPN-client.  

Is there a way I can build the lab without getting a certificate?

[jimmyc_2]

To follow up, has anyone used OpenSSL to build a certificate and use it on Anyconnect/ASA?

[Marvin Rhoads]

AnyConnect does not require certificates if you use SSL VPN (vs. IKEv2 IPsec VPN). On an SSL VPN you can use local authentication on the ASA or external authentication to AD, LDAP, RADIUS, etc. (in addition to or instead of certificates).

If you want to use IKEv2 and certificate authentication you can use either the ASA itself the CA server or proxy (via SCEP) to an internal CA (e.g. a Windows servers with Certificate Services). There are some other possible methods (such as the way you asked about) but in my experience they are not commonly used as few users have the knowledge or desire to go that route. Most organizations using client certificates deploy them from an internal root CA.

[jimmyc_2]

Thank you Marvin,

Several years ago, the IPSec method was deemed more secure than SSL.

 From a practical perspective, is using AnyConnect with SSL more or less the equivalent of IPSec?

[Marvin Rhoads · Accepted solution]

Practically speaking you can accomplish just about everything with SSL VPN (AnyConnect client) that you could with IPSec VPN (legacy IPsec or 3rd party client).

You get the advantage of modern OS support (i.e. Windows 8 etc.) and the ability to add a lot of other features (with AnyConnect Premium licensing) and integrate other modules such as NAM and Cloud Web Security etc..