Split RADIUS for client VPN based on Group authentication

[George_R]

Hi Team,

I have a Meraki MX client VPN setup which authenticates with a radius server and Duo.

I need to implement an Azure MFA but need to keep it in testing mode for some time.

What I did was, installed an NPS and Azure MFA extension on a separate server and went to configure a secondary RADIUS server in Meraki Client VPN page but then I started wondering:

How to instruct existing setup that Please authenticate Group A with old radius server and Group B with new RADIUS?

Is it even possible?

[MartinLL]

I dont think you can do that. The secondary radius server in the list will only be used if the primary goes down.

If i were you i would pick a site or talk to your Cisco rep to get a vMX trial license that you can use to test the new radius server. Simply create a new network, add the client vpn config and create a new anyconnect profile you can install on test clients.

When you are happy with the result you simply change the radius server on your production network.