Documentation Feedback: Client VPN Overview

[MerakiCommunity]

This is the community thread for feedback and questions on the documentation article Client VPN Overview

[MerakiSA]

Can you add a link for VPN Settings for Windows 11?

[Tray]

Hey, I am happy to help you with this. Configuring the Client VPN for Windows 11 is the same as Windows 10.

[Shahnaz]

Can you please expand on what subnet to use for "subnet for client VPN"?

[TG1]

You enter whatever subnet you wish you use and that will be the scope of the DHCP assignment to the VPN clients.

[Apashkou]

Team, for this section:

'Group Policy applied to a client VPN user is associated with the username and not the device. Different devices that connect to client VPN with the same username will receive the same group policy."

Can we add the part that explains that this is only true if we are tracking by mac. When tracking by mac, the "MAC" seen in the client page is a hash of the username and that is what allows the GP to be applied to a specific username.
 
When tracking by IP, that ability is lost - and unfortunately, it looks like there is no way to make a fixed association between username and IP.

[iConnect]

When you assign a policy group to a client VPN, it looks like it is associated to a username but is not because if you connect from anohter computer using the same credentials, this new connection skip the policies applyed previuosly.

Looks like there is no way to apply group policies to usernames, only computers/phones/tables.

[Kovacsteps]

Is 2FA available with the MX400 or is a 3rd party required. Like is there a configuration spot where we can set up Google auth or whatever?

[Max_DrSalomon]

Is possible to use the same IP Addressing of one internal LAN interface? This avoid problem about Enterprise internal routing and permit to use the same policy already installed.

[Fernando_R]

It is not possible to do this. When trying, meraki will throw an error. For VPN clients, you must assign a different segment than the one already configured for the LAN.

[Fernando_R]

What is the point of using AD for VPN clients, otherwise it does not allow me to use the security policies applied to each group? This is a security bug, that any VPN user can access the content of the entire network. There is no way to apply restrictions for VPN clients? What does @Meraki say about all this?

[ecoen]

Can Client VPN be used on a one arm VPN concentrator (MX)? If so, what is the trick to allow the client to connect?