Which requirement is needed to use local authentication for Cisco AnyConnect Secure Mobility Clients that connect to a FlexVPN server?

Certificate-based authentication is an alternative method to username/password, not a prerequisite for enabling local credential-based authentication on FlexVPN.

EAP-AnyConnect is one supported EAP method in certain deployments but is not the specific configuration requirement for enabling local authentication on a FlexVPN server.

EAP query-identity is a mechanism for requesting an EAP identity but is not a prerequisite for local authentication on a FlexVPN headend.

An AnyConnect profile is required on the FlexVPN headend to support local AAA authentication for connecting AnyConnect clients. The profile defines client behavior and authentication parameters; without it, the IOS/IOS-XE headend cannot process local credentials submitted by AnyConnect clients during IKEv2 negotiation.