Is strong 2FA with client cert and AD using AnyConnect possible?

[jaime.castells]

Is it possible to configure AnyConnect to require a client cert that matches the AD username?  Which attribute should be used?  Common name (CN) or something else?  Can anyone point me to the appropriate documentation on setting up this configuration?

Thanks in advance!

[Marcin Latosiewicz]

Jaime, 

If you want binary comparison of the certificate I  believe it's only possible with EAP methods. 

That being said, you can extract multiple things from certificate to be used a authentication username. 

Have a look at this doc 

http://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/116111-11611-config-double-authen-00.html

It shows a couple of different ways to do this on ASA.

On IOS, I'd suggest looking at FlexVPN feature. 

M.