AnyConnect SAML Group Policy assignment

[Ruben2]

Does anyone know of a way to assign a group policy to a VPN Session via SAML Authentication?

With radius Authentication you can pass back an attribute that would put the VPN Session into a Group Policy.

Is this possible with SAML Authentication as well?

[Inderdeep]

@Ruben2 : check this out 

https://documentation.meraki.com/MX/AnyConnect_on_the_MX_Appliance/Authentication 

[PhilipDAth]

You can't do it ... yet.

[Lukef]

Is this still the case?

[PhilipDAth]

It is still the case.

[joaro]

@PhilipDAth 
Do you know if there is an update to this?

[PhilipDAth]

It is still a work in progress.

[thomasthomsen]

".... yet" ... have you heard anything about this being talked about ? 🙂

[PhilipDAth]

Alas it is still a work in progress.

[thomasthomsen]

have anyone noticed that this (Group Policy) does not even work statically with anyconnect and SAML ?

I just tested with a customer, and the static Group policy in the config (at the very bottom of the page) does nothing.

It works fine in non-SAML ... how strange.

[El-Bandito]

@PhilipDAth   Hey Philip,  you seemed pretty helpful wanted to ask you about this topic.   I am trying to do Cisco AnyConnect w/ SAML authentication with Microsoft Azure..  do you know if this is still a limitation where group policy cannot be applied if SAML is being used? 

And if it's not possible, is there any workaround for it?  I was looking at Azure, and their conditional access policies don't support time-based restrictions.. which is what I'm trying to implement in group policy. 

Our company has a requirement where VPN access has to be restricted from 8am-5pm.  

[PhilipDAth]

>do you know if this is still a limitation where group policy cannot be applied if SAML is being used? 

It is being worked on, but is not available today.

>Our company has a requirement where VPN access has to be restricted from 8am-5pm.

I haven't tried this - but try configuring the default AnyConnect group policy and put a schedule in there.

https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Creating_and_Applying... 

You might need to do something like configure the firewall rules to block everything, and then use the schedule to allow access.

[MichielQ]

It baffles me for how long SAML is already supported for AnyConnect, but group policy support has been missing ever since. It's just not a viable authentication mechanism if you would like to design separate access policies in Meraki dashboard. Hopefully the team at Secure Client puts this somewhere at the top of their list.

[El-Bandito]

We're now headed in a different direction.  Going with Fortigate for SSLVPN w/ SAML Authentication to O365.  Without rules for vpn traffic, we can't continue to use Meraki.

[znet]

We are waiting for this very important function too and hope that meraki will implement this soon!