Meraki Client Vpn 2fa

Posted on  by



Cisco Meraki Client VPN can be configured to use a RADIUS server to authenticate remote users against an existing userbase.

This article outlines the configuration requirements for RADIUS-authenticated Client VPN, as well an example RADIUS configuration steps using Microsoft NPS on Windows Server 2008.

RADIUS Configuration

I set up Client VPN with Azure MFA using and on prem RADIUS server (didn't go as far as looking at Conditional Access) but the issue I had was the only MFA method supported is app notification and most of my users prefer to use SMS for MFA (the problems we get when people change phones using the app is a real pain) so it was never implemented. Log onto the Cisco Meraki Dashboard and navigate to Configure Client VPN. Select the option to enable the Client VPN Server. Set the Client VPN Subnet. This will be a unique IP subnet offered to clients connecting to the MX Security Appliance via a Client VPN connection. By default, the Client VPN timeout on the Meraki Security Appliances is 15 seconds. For there to be enough time for the authentication to complete this must be extended. To extend this you will have to open a support case via the Meraki dashboard and ask to have it extended.

While any RADIUS server can be used, the following configuration requirements are necessary for Client VPN integration:

  • RADIUS must be configured to allow PAP (unencrypted authentication)

Note: Communication between the client and the MX will be encapsulated within IPsec, so this does not mean that client communication is unencrypted.

  • The MX/Z1's IP address must be configured on the server as a RADIUS client/authenticator, with a shared secret.

Please refer to your RADIUS server vendor's documentation for configuration specifics.

Example RADIUS Server Configuration (Windows NPS + AD)

The following example configuration outlines how to configure an existing Windows 2008 server, running Network Policy Server (NPS) alongside Active Directory:

  1. Add the MX Security Appliance as a RADIUS client on the NPS server.
  2. Configure a RADIUS Connection Request in NPS.
  3. Configure a RADIUS Network policy in NPS.

Note: This configuration assumes that NPS is already running on the Windows server. Please refer to Microsoft documentation for assistance in running NPS.

Add MX Security Appliance as RADIUS clients on the NPS server

In order for the MX to act as an authenticator for RADIUS, it must be added as a client on NPS.

  1. Open the NPS Server Console by going to Start > Programs > Administrative Tools > Network Policy Server.
  2. In the Left pane, expand the RADIUS Clients and Servers option.
  3. Right-click the RADIUS Clients option and select New.
  4. Enter a Friendly Name for the MX Security Appliance or Z1 Teleworker Gateway RADIUS Client.
  5. Enter the IP Address of your MX Security Appliance or Z1 Teleworker Gateway. This IP will differ depending on where the RADIUS server is located:
    • On a local subnet - Use the IP address of the MX/Z1 on the subnet shared with the RADIUS server.
    • Over a static route - Use the IP address of the MX/Z1 on the subnet shared with the next hop.
    • Over VPN - Use the IP address of the MX/Z1 on the highest-numbered VLAN in VPN.
  6. Create and enter a RADIUS Shared Secret (make note of this secret - we will need to add this to the Dashboard).
Vpn

Note: Currently only ASCII characters are supported for RADIUS shared secrets - Unicode characters will not work correctly.

  1. Press OK when finished.

For additional information or troubleshooting assistance, please refer to Microsoft documentation.

Configure a RADIUS Connection Request

  1. In the NPS Server Console, navigate to Policies > Connection Request Policies.Right-click the Connection Request Policies folder and select New.
  2. In the Connection Request Policy Wizard, enter a Policy Name and select the Network Access Server Typeunspecified then press Next.
  3. Click Add to add conditions to your policy. Access Request messages will need to meet these conditions to be allowed access.
  4. From the list of conditions select the option for Framed-Protocol. Press Add and place a check next to the PPP option then press Ok.
  5. Click Add to add another condition and select the option for CallingStationID. Enter CLIENTVPN into the text box and press Next.
  6. On the next three pages of the wizard we will leave the default settings. Press Next on these pages to continue.
  7. Review the settings then press Finish.

Configure a RADIUS Network Policy

  1. In the Left pane of the NPS Server Console, right-click the Network Policies option and select New.
  2. In the Network Policy Wizard enter a Policy Name and select the Network Access Server type unspecified then press Next.
  3. Click Add to add conditions to your policy.
  4. From the list of conditions, select the option for Windows Groups. Click Add Groups and enter the name of Windows Group you would like to give Client VPN permission.
  5. Click Add to add an additional condition. Select the option for Framed Protocol, press add and check the PPP option then press Ok
  6. Click Add to add a final condition. Select the option for CallingStationID. Enter CLIENTVPN into the text box and press Next.

Note: Some versions of Windows Server require that the CallingStationID is omitted. If you are unable to establish connectivity, remove the CallingStationID and leave the field blank.

  1. Leave the default settings on the Specify Access Permission page and press Next.
  2. Deselect all checkboxes and select Unencrypted authentication (PAP, SPAP). An informational box will be displayed press No to continue and press Next. For security information about using PAP click here.
  3. The next 2 pages of the wizard we will leave the default settings. Press Next on these pages to continue.
  4. Review the settings then press Finish.

Dashboard Configuration

Once a RADIUS server has been configured appropriately, the following steps outline how to configure Client VPN to use RADIUS:

  1. Log onto the Cisco Meraki Dashboard and navigate to Configure > Client VPN.
  2. Select the option to enable the Client VPN Server.
  3. Set the Client VPN Subnet. This will be a unique IP subnet offered to clients connecting to the MX Security Appliance via a Client VPN connection.
  4. Specify the DNS servers.
  5. Enter a shared secret that will be used by the client devices to establish the VPN connection.

Note: This is a different value from the RADIUS shared secret.

  1. Select RADIUS as the Authentication method.
  2. Click the Add a RADIUS Server link.
    1. Enter your RADIUS Host IP Address.
    2. Enter the RADIUS Port that the MX Security Appliance will use to communicate to the NPS server. The default port is 1812.
    3. Enter the RADIUS Shared Secret (established when the MX was added as an authenticator).
  3. Click Save changes.

Client Configuration

Installation of additional software is not required on client devices. The Cisco Meraki Client VPN solution uses L2TP over IPsec, which is supported by almost all device's built-in native clients.

Please refer to our Client VPN documentation for client configuration instructions.

Additional Resources

For additional information about Client VPN, please refer to the following articles:

This page provides instructions for configuring client VPN services through the Dashboard.

For detailed instructions on how to configure a client VPN connection on various client device platforms, please refer to:

Client VPN

The client VPN service uses the L2TP tunneling protocol and can be deployed without any additional software on PCs, Macs, iOS devices, and Android devices, since all of these operating systems natively support L2TP VPN connections.

Note: TLS (SSL) Client VPN is supported on the MX with AnyConnect. To learn more, see AnyConnect on the MX

Note: Linux-based operating systems can support client VPN connections as well, although third-party packages may be necessary to support L2TP/IP.

Note: Establishing a client VPN connection when the client is located on the LAN of the MX is unsupported.

Encryption Method

Client VPN uses the L2TP/IP protocol, with the following encryption and hashing algorithms: 3DES and SHA1 for Phase1, AES128/3DES and SHA1 for Phase2. As a best practice, the shared secret should not contain any special characters at the beginning or end.

Owing to changes in the PCI-DSS Standard version 3.2.1, some auditors are now enforcing requirements for stronger encryption than the Meraki Client VPN default settings provide. Please contact Meraki Support if you need these values adjusted, but please be aware that some client devices may not support these more stringent requirements (AES128 encryption with DH group 14 - Required by PCI-DSS 3.2.1).

Client VPN Server Settings

To enable Client VPN, choose Enabled from the Client VPN server pulldown menu on the Security Appliance > Configure > Client VPN page. The following Client VPN options can be configured:

  • Client VPN Subnet: The subnet that will be used for Client VPN connections. This should be a private subnet that is not in use anywhere else in the network. The MX will be the default gateway on this subnet and will route traffic to and from this subnet.
  • Hostname: This is the hostname of the MX that Client VPN users will use to connect. This hostname is a DDNS host record correlating to the Public IP address of the MX. You can change this hostname by following the instructions here.
  • DNS server: The servers VPN Clients will use to resolve DNS hostnames. Chose from Google Public DNS, OpenDNS, or specifying custom DNS servers by IP address.
  • WINS server: If VPN clients should use WINS to resolve NetBIOS names, select Specify WINS Servers from the drop-down and enter the IP addresses of the desired WINS servers.
  • Shared secret: The shared secret that will be used to establish the Client VPN connection.
  • Authentication: How VPN Clients will be authenticated (see below).
  • Systems Manager Sentry VPN security: Configuration settings for whether devices enrolled in systems manager should receive a configuration to connect to the Client VPN (see below Systems Manager Sentry VPN Security section).

Authentication

Meraki Client VPN uses the Password Authentication Protocol (PAP) to transmit and authenticate credentials. PAP authentication is always transmitted inside an IPsec tunnel between the client device and the MX security appliance using strong encryption. User credentials are never transmitted in clear text over the WAN or the LAN. An attacker sniffing on the network will never see user credentials because PAP is the inner authentication mechanism used inside the encrypted IPsec tunnel.

The authentication itself can be performed by using these three options: the Meraki cloud, RADIUS, or Active Directory. Below, the three options are discussed.

Meraki Cloud Authentication

Use this option if an Active Directory or RADIUS server is not available, or if VPN users should be managed via the Meraki cloud. To add or remove users, use the User Management section at the bottom of the page. Add a user by clicking 'Add new user' and entering the following information:

  • Name: Enter the user's name.
  • Email: Enter the user's email address.
  • Password: Enter a password for the user or click 'Generate' to automatically generate a password.
  • Authorized: Select whether this user is authorized to use the Client VPN.

To edit an existing user, click on the user under the User Management section. To delete a user, click the X next to the user on the right side of the user list.

When using Meraki hosted authentication, the user's email address is the username that is used for authentication.

RADIUS

Use this option to authenticate users on a RADIUS server. Click Add a RADIUS server to configure the server(s) to use. Enter in the IP address of the RADIUS server, the port to be used for RADIUS communication, and the shared secret for the RADIUS server.

For more information on how to configure Radius authentication for Client VPN, refer to the documentation on Configuring RADIUS Authentication with Client VPN.

Note: If multiple RADIUS servers are configured, RADIUS traffic will not be load balanced.

Active Directory

Meraki Client Vpn 2fa Free

Use this option if user authentication should be done with Active Directory domain credentials. You will need to provide the following information:

  • Short domain: The short name of the Active Directory domain.
  • Server IP: The IP address of an Active Directory server on the MX LAN or a remote subnet routable through AutoVPN.
  • Domain admin: The domain administrator account the MX should use to query the server.
  • Password: Password for the domain administrator account.

For example, considering the following scenario: Users in the domain test.company.com should be authenticated using an Active Directory server with IP 172.16.1.10. Users normally log into the domain using the format 'test/username' and you have created a domain administrator account with the username 'vpnadmin' and the password 'vpnpassword'.

  • The Short domain would be 'test'.
  • The Server IP would be 172.16.1.10.
  • The Domain admin would be 'vpnadmin'.
  • The Password would be 'vpnpassword'.

Refer to the Active Directory documentation for more information about integrating AD with Client VPN.

Note: At this time, the MX does not support mapping group policies via Active Directory for users connecting through the Client VPN.

Systems Manager Sentry VPN Security

When using Meraki cloud authentication, Systems Manager Sentry VPN security can be configured If your Dashboard organization contains one or more MDM networks. Systems Manager Sentry VPN security allows for devices enrolled in Systems Manager to receive the configuration to connect to the Client VPN through the Systems Manager profile on the device.

To enable Systems Manager Sentry VPN security, choose Enabled from the Client VPN server pulldown menu on the Security Appliance > Configure > Client VPN page. You can configure the following options:

  • Install Scope: The install scope allows for a selection of Systems Manager tags for a particular MDM network. Devices with these tags applied in a Systems Manager network will receive a configuration to connect to this network's Client VPN server through their Systems Manager profile.
  • Send All Traffic: Select whether all client traffic should be sent to the MX.
  • Proxy: Whether a proxy should be used for this VPN connection. This can be set to automatic, manual, or disabled

When using Systems Manager Sentry VPN security, the username and password used to connect to the client VPN are generated by the Meraki cloud.

Usernames are generated based on a hash of a unique identifier on the device and the username of that device. Passwords are randomly generated.

Client VPN Connections

After configuring Client VPN and users are starting to connect, it may be useful to see how many and what client devices are connected to your network via Client VPN. To see connected Client VPN devices, navigate to Network-wide > Clients > click the dropdown icon on the Search clients... search bar > make sure to select Client VPN and either Online, Offline or both.

Client

Meraki Client Vpn 2fa Chrome

Group Policies

It is possible to manually apply group policies to clients connected via Client VPN. Group Policy applied to a client VPN user is associated with the username and not the device. Different devices that connect to Client VPN with the same username will receive the same group policy. For more help on assigning or removing group policies applied to a client, refer to the Creating and Applying Group Policies document.

Cisco Vpn 2fa

Note: It is not possible to assign group policies automatically once a user connects to Client VPN.

FAQs Page

If further guidance is required, please feel free to visit the FAQs page built into Client VPN page (Security Appliance > Configure > Client VPN > FAQs). The FAQs contain answers and links (KB Articles and Dashboard pages) to the most common Client VPN inquiries. Below is a snippet of the FAQs page.

Meraki Vpn Client Setup