Refer to the exhibit. An administrator had the above configuration working with SSL protocol, but as soon as the administrator specified IPsec as the primary protocol, the Cisco AnyConnect client…

IPsec is not incompatible with a group URL in general; the problem is specifically that IKEv2 requires an exact tunnel group name match in the User Group field, not that group URLs cannot coexist with IPsec configurations.

The restriction is not about two group URLs being identical; the core issue is that IPsec/IKEv2 uses the User Group as a literal tunnel group name, not a URL-based selector.

With IPsec/IKEv2, AnyConnect uses the User Group value to identify the correct tunnel group on the ASA by its exact configured name, because IKEv2 does not support group URL-based tunnel group selection the way SSL/TLS does. If the User Group does not precisely match the tunnel group name, the ASA cannot map the client to the correct connection profile, causing the connection to fail. Changing from SSL to IPsec without updating this value is the specific misconfiguration shown in the exhibit.

Creating a new XML profile is unnecessary; the fix requires only correcting the existing profile's User Group field to exactly match the tunnel group name on the ASA.