I found the solution: it's a common issue with AnyConnect DTLS negotiation. You need to open UDP port 443 alongside TCP port 443 on the MX/vMX firewall. ... View more

There will be a tool for client management, but stay tuned for that. ... View more