When doing major software upgrades on an ASA, I found that AnyConnect sessions will authenticate successfully but not initiate access. The error message on the client was “Login denied, unauthorized connection mechanism”. There were no logs on the server side.
You’d think the problem would be in the tunnel group policy, but it’s actually in the group policy, where ‘ssl-client’ must be included:
group-policy MyGroup attributes vpn-idle-timeout 120 vpn-session-timeout none vpn-tunnel-protocol ikev2 ssl-client
Layer 77 