AnyConnect Auto Connect After Login Without Password (Meraki MX)

[jOMeraki2]

Hi,

I’m using Cisco AnyConnect with a Meraki MX.

Is there a way to make the VPN connect automatically after the user logs in, without asking for username and password every time?

Maybe using SSO?

Thanks!

[alemabrahao · Accepted solution]

Only using certificate-based authentication.

Sentry AnyConnect VPN is a special Cisco Meraki integration between MX and Systems Manager (SM) enrolled devices. This allows secure and automatic certificate-based Always-On AnyConnect VPN for SM managed devices. SM managed devices will be sent all the necessary configurations, certificates, and app settings for an Always-On VPN tunnel back to the MX. For SM enrolled devices, the end users are not interrupted with any authentication/setup steps and the VPN tunnel will open automatically. 

https://documentation.meraki.com/SASE_and_SD-WAN/MX/Design_and_Configure/Configuration_Guides/Client....

[GIdenJoe]

This document has not been updated in a while (https://documentation.meraki.com/SASE_and_SD-WAN/MX/Design_and_Configure/Configuration_Guides/Client...) However it says there that Cert only authentication is a beta feature.

You can always configure always-on in the Secure Client VPN profile editor however to avoid any login prompts you would indeed need to be able to use certificates only to avoid the login prompt.  However this does present security issues because you are not using MFA at that point.

Inside the profile editor you can configure a DNS check that will see if you are on the local network of the company or not (trusted network).  If not it will automatically create the VPN.