Refer to the exhibit. The customer can establish an AnyConnect connection on the corporate office only. Subsequent attempts fail. What might be the issue?

AnyConnect SSL VPN does not rely on IKEv2 by default, and a successful first connection rules out a path-level protocol block.

UserGroup must match - not differ from - the connection profile name; this answer describes the exact condition that causes the failure.

SSL is commonly the default protocol, but changing the primary protocol does not resolve a UserGroup-to-connection-profile name mismatch.

The AnyConnect XML client profile uses the UserGroup field to identify which connection profile (tunnel-group) on the ASA the client should target. When UserGroup does not match the tunnel-group name, the ASA cannot map the connection to the correct group policy and authentication realm, causing subsequent connection attempts to fail. Since the first connection typically uses the default group, a mismatch only manifests on directed reconnection attempts.