问题：

[多选] Which three statements about the Cisco Easy VPN feature are true？（）

A . If the VPN server is configured for Xauth， the VPN client waits for a username / password challenge.
B . The Cisco Easy VPN feature only supports transform sets that provide authentication and encryption.
C . The VPN client initiates aggressive mode （AM） if a pre-shared key is used for authentication during the IKE phase 1 process.
D . The VPN client verifies a server username/password challenge by using a AAA authentication server that supports TACACS+ or RADIUS.
E . The VPN server can only be enabled on Cisco PIX Firewalls and Cisco VPN 3000 series concentrators.
F . When connecting with a VPN client，the VPN server must be configured for ISAKMP group 1，2 or 5.