Configure AnyConnect profile download

Updated: March 10, 2026

Want to summarize with AI?

Configure AnyConnect profile download on the SD-WAN RA headend device using a CLI add-on template in Cisco SD-WAN Manager.

Configure AnyConnect profile download functionality on the Cisco Catalyst SD-WAN remote access headend device to enable client profile distribution.

In Cisco SD-WAN Manager, use a CLI add-on template for the SD-WAN RA headend device to configure the AnyConnect profile download functionality.

Before you begin

Ensure that you have an AnyConnect profile XML file available. Step 3 uses the file. For information about AnyConnect profiles, see the documentation for AnyConnect.

Follow these steps to configure AnyConnect profile download:

Procedure

Disable HTTP secure server functionality.
Example:
```
no ip http secure-server 
```

Configure SSL policy and specify the Cisco Catalyst SD-WAN remote access WAN IP as the local address for profile download.

Example:

crypto ssl policy sdra_anyconnect_profile_download 
 pki trustpoint sdra_pki_trustpoint  sign 
 ip address local sdra_wan_ip port 443

Copy the AnyConnect profile XML file to the SDremote access headend bootflash and specify the path.
Example:
```
crypto vpn anyconnect profile sdra_anyconnect_profile  bootflash: sdra_anyconnect_profile.xml 
```
Note

You can copy the AnyConnect profile XML file to the Cisco Catalyst SD-WAN remote access headend bootflash from a host reachable in a service VPN, using the secure copy command on the Cisco Catalyst SD-WAN remote access headend.

Specify the AnyConnect profile name in the IKEv2 profile.

Example:

crypto ikev2 profile sdra_ikev2_profile 
 anyconnect profile sdra_anyconnect_profile

The AnyConnect profile download is configured on the headend device. The following example shows the complete configuration:

no ip http secure-server
!
crypto ssl policy sdra_anyconnect_profile_download
 pki trustpoint sdra_pki_trustpoint sign
 ip address local 172.16.1.1 port 443
!
crypto vpn anyconnect profile sdra_anyconnect_profile bootflash: sdra_anyconnect_profile.xml
!
crypto ikev2 profile sdra_ikev2_profile
anyconnect profile sdra_anyconnect_profile

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.