Hello all,
I might have a quick question.
But first, context - I was helping one of our contractors with troubleshooting why they could not connect to our ASA via Cisco AnyConnect. We were able to get the client downloaded and installed on their machine and when they went to connect they were able to select which profile/group to use. However after authentication and Duo MFA we kept receiving this error:
Logon denied, unauthorized connection mechanism, contact your administrator.
Which was odd. A quick couple of searches yielded the the following response:
This error message occurs mostly because of configuration issues that are improper or an incomplete configuration.
Check the configuration and make sure it is as required to resolve the issue.
Which is also not very helpful. Further googling led me to this solution, which appears to have done the trick. Essentially I needed to select a VPN tunneling protocol in the group policy attached to the profile they were using. Initially the only tunneling option I had selected "IKEv2" for both our FTE profile and out Contractors profile. I added the `ssl-client` to the contractor profile's group policy and they were then able to login.
Here is where my question comes in:
Why, if only IKEv2 was enabled on the policy, were both contractors and FTEs able to login using Cisco AnyConnect and the web client? I have had contractors using the profile before and AnyConnect without issue. Same goes for the FTE's as well. The issue appears to be fixed and I have added the `ssl-client` option to both profiles just to be sure.
Any ideas or thoughts on why it worked for some and not others without it being explicitly selected?
