cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
17708
Views
20
Helpful
4
Replies

Cisco Anyconnect SSL VPN vs AnyConnect IPSec

B. BELHADJ
Enthusiast
Enthusiast

Hello,

Can anyone tell me what is the difference between the Anyconnect SSL VPN and Anyconnect IPSec VPN.

When we use the one and not the other?

Thank you so much.

Best regards.

1 Accepted Solution

Accepted Solutions

Dinesh Moudgil
Cisco Employee
Cisco Employee

Hello Abdollah,

Anyconnect based on SSL protocol is called Anyconnect SSL VPN and if you deploy Anyconnect with IPSec protocol ,it is called IKev2. 

Anyconnect (using IKEv2 or SSLVPN) doesn't use a pre-shared-key to authenticate the user.  A certificate will be used to authenticate the ASA and either/both user+pass and certificate is used to authenticate the user.  The XML profile is needed just to make the Anyconnect client use IKEv2 rather than the default of SSL when connecting to the ASA.

Here is the doc listing some of the benefits of using Anyconnect with Ikev2 as opposed to SSL VPN.
http://www.cisco.com/en/US/docs/ios-xml/ios/sec_conn_ike2vpn/configuration/15-2mt/sec-cfg-ikev2-flex.html#GUID-6548042E-1E4C-416A-8347-00DCF96F04DF

In essence, if you have got a fairly simple deployment , then you can go with SSL VPN setup and if you want to leverage additional features, you can use Anyconnect with IPSec.

Regards,
Dinesh Moudgil

P.S. Please rate helpful posts.

Cisco Network Security Channel - https://www.youtube.com/c/CiscoNetSec/

View solution in original post

4 Replies 4

Dinesh Moudgil
Cisco Employee
Cisco Employee

Hello Abdollah,

Anyconnect based on SSL protocol is called Anyconnect SSL VPN and if you deploy Anyconnect with IPSec protocol ,it is called IKev2. 

Anyconnect (using IKEv2 or SSLVPN) doesn't use a pre-shared-key to authenticate the user.  A certificate will be used to authenticate the ASA and either/both user+pass and certificate is used to authenticate the user.  The XML profile is needed just to make the Anyconnect client use IKEv2 rather than the default of SSL when connecting to the ASA.

Here is the doc listing some of the benefits of using Anyconnect with Ikev2 as opposed to SSL VPN.
http://www.cisco.com/en/US/docs/ios-xml/ios/sec_conn_ike2vpn/configuration/15-2mt/sec-cfg-ikev2-flex.html#GUID-6548042E-1E4C-416A-8347-00DCF96F04DF

In essence, if you have got a fairly simple deployment , then you can go with SSL VPN setup and if you want to leverage additional features, you can use Anyconnect with IPSec.

Regards,
Dinesh Moudgil

P.S. Please rate helpful posts.

Cisco Network Security Channel - https://www.youtube.com/c/CiscoNetSec/

Hello Dinesh,

Thank you for your reply, that was helpful :)

So for complex architectures, IKEv2 is recommended than SSL?

Best regards.

That is right, you can leverage the benefits of Ikev2 for complex deployments but it is more or less dependent directly on your needs rather complexity,

Regards,
Dinesh Moudgil

P.S. Please rate helpful posts.

Cisco Network Security Channel - https://www.youtube.com/c/CiscoNetSec/

Can you maybe detail the complexities/flexibility/features that IKEv2 gives you over SSL?

 

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Recognize Your Peers