Cisco ASA VPN ikev2 LDAP authentication

[gabriele-lngs]

Hello,

I'm trying to configure a VPN server (Cisco FirePower 1100) for Remote Access,
using IKEv2 with PSK and LDAP for user authentication.

So far I'm was able to correctly set the IKEv2 part,
but the problem is that every connection is accepted,
without asking for user credentials.

My current configuration looks like this:

aaa-server MY-LDAP protocol ldap
aaa-server MY-LDAP (outside) host ldap.mysite.com
 ***** hidden, but it works (tested with ikev1) *****

crypto ipsec ikev2 ipsec-proposal ipsec-proposal
 protocol esp encryption aes-256 aes-192 aes
 protocol esp integrity sha-256 sha-1

crypto dynamic-map DYNMAP 1 set ikev2 ipsec-proposal ipsec-proposal
crypto dynamic-map DYNMAP 1 set reverse-route
crypto map CMAP 1 ipsec-isakmp dynamic DYNMAP
crypto map CMAP interface outside

crypto ikev2 policy 1
 encryption aes-256
 integrity sha512 sha256
 group 21 20 19 16 15 14
 prf sha512 sha256
 lifetime seconds 86400
crypto ikev2 enable outside

group-policy DefaultRA internal
group-policy DefaultRA attributes
 vpn-tunnel-protocol ikev1 ikev2 ssl-client ssl-clientless
 group-lock value DefaultRAGroup
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value def_acl

tunnel-group DefaultRAGroup general-attributes
 address-pool vpn-client-pool
 authentication-server-group MY-LDAP
 authorization-server-group MY-LDAP
 default-group-policy DefaultRA
tunnel-group DefaultRAGroup ipsec-attributes
 ikev2 remote-authentication pre-shared-key *****
 ikev2 local-authentication pre-shared-key *****

For the client testing, I'm using a mac, with the following configuration setted:
    Under Settings -> Network -> new VPN(IKEv2)
    server address = remote ID = vpn.mysite.com
    Authentication Settings -> Shared Secred = myPSK

Thank You in advance,
Gabriele

[MHM Cisco World]

 default-group-policy DefaultRA

 group-lock value DefaultRAGroup <<- THIS MUST CHANGE TO MATCH THE GROUP-POLICY DefaultRA 

[gabriele-lngs]

---

@MHM Cisco World wrote:

 group-lock value DefaultRAGroup <<- THIS MUST CHANGE TO MATCH THE GROUP-POLICY DefaultRA 

---

I don't fully understand.
I tried to remove this line from the configuration (`no group-lock`), but the outcome remains the same.

[MHM Cisco World]

outcome be same for any anyconnect connect before, you must try new user or clear the anyconnect vpn-sessiondb. 

[gabriele-lngs]

I tried but still same result: I can connect without being asked for credentials.

For clarity, I'm not using anyconnect on my client, but the macOS vpn software, under settings->network->vpn(ikev2)