Anyconnect on MX and vMX

[bubblewrap]

Hi, we recently deployed a Meraki vMX to Azure and am trying to find documentation on setting up AnyConnect so that our users can connect to the Azure resources through the Azure Meraki vMX.

Also, if we have Meraki on premise and have Anyconnect configured to the on-premise/in office MX, how will the Anyconnect client work? We don't users to have to manage multiple entries, can we use a DNS service? We would want our users to connect to the Azure vMX in case of a DR scenario.  Or Will Meraki's built-in DNS recognize it?

Thanks.

[CptnCrnch]

You will have to explicitly configure which Anyconnect headend the users will be connecting to.

Such as setup ion your case could look like this:

1. Your users still connect to your on prem MX and will have access to your internal data
2. Your on prem MX builds an automatic AutoVPN tunnel to your vMX in Azure. This way, your internal users as well as your roaming clients will be able to access resources within Azure.

This could also be working the other way around, but you'll have to keep in mind that there are possible limitations posed by Azure for outgoing traffic from your Anyconnect clients.

[bubblewrap]

Thanks,

But what if we are in a DR scenario where our prem MX goes down and users need to connect to Azure vMX using Anyconect? 

Will it be...
For on-premise : https://mx100-whatever-dynamic-m.com/
For vMX Azure - https://mx100-whatever-1-dynamic-m.com/

Something like that? Is there a way to do automatic failover if on prem MX goes down?


I also noticed the below on Reddit....are these solutions possible?
https://www.reddit.com/r/meraki/comments/q7szpt/custom_meraki_hostname/
https://www.reddit.com/r/meraki/comments/dp9hhj/point_dns_a_record_to_meraki_firewall_hostname/



 

[CptnCrnch]

How about configuring vMX as Backup Server?

[bubblewrap]

Will this work with Meraki? 
So in the profile editor I put
https://mx100-whatever-dynamic-m.com/
https://mx100-whatever-1-dynamic-m.com/

Note we currently have Anyconnect deployed through our ASAs (moving to Meraki), and I don't believe we use .pcf files or anything.

[CptnCrnch]

As written above: I'd simply configure https://mx100-whatever-1-dynamic-m.com/ as Backup Server using the Profile Editor and push out that profile via GPO.