AnyConnect VPN - Migration from ASA to Meraki MX84

[CCIE19763]

Hi All. 

I have a customer that purchased an MX84 v14.39 and will be migrating away from an ASA which has AnyConnect.

From my search on the interwebs; Meraki doesnt support AnyConnect.

Is this a fact?

Thank you.

[SoCalRacer]

Correct, Meraki doesn't support AnyConnect.

[MerakiDave]

Not at this time but it is an active feature request and is being developed, however no timeline to share yet.

[svennerski]

Interesting. I'd really like to see this feature.

[cb123]

Fact.

Just throw the ASA behind the MX, forward the ports and do VPN on a stick.  That is what I am having to do at 2 of my VPN points and it works fine.

[CCIE19763]

Thanks for the suggestion however, my customer is renting the ASA and will be replaced by the Meraki.

[SoCalRacer]

I am assuming you will be using Windows computers, within I would say get comfortable using powershell to deploy the vpn profile. Windows breaks it all the time.

[Nash]

---

@SoCalRacer wrote:

I am assuming you will be using Windows computers, within I would say get comfortable using powershell to deploy the vpn profile. Windows breaks it all the time.

---

I've got some scripts you can adapt if you'd like, for Win10. Read the comments. Make changes as necessary. Do what you want. 🙂 

It's set to change the phonebook so your computer doesn't try to log into remote servers using Meraki cloud credentials. Creates a rasphone desktop shortcut to avoid issues with the pretty Windows 10 "overlay", such as saying "Connecting..." forever. 

It can add a registry key that fixes a Windows 10 problem with NAT-Traversal, if you want. You can also use em to setup split tunnels.

I'm not promising that they're the best, but they've significantly reduced the number of repeat "my VPN is broken" tickets that need escalating from my tier 1 help desk.

N.B. The big gotcha is that Meraki's built-in client VPN has one group to rule them all. You can't setup multiple groups with custom restricted access like you can with ASAs and AnyConnect.

[DSCP_jpk]

What did you end up doing? Thanks!

[DSCP_jpk]

Does this config allow the MX to inspect the RA-VPN internet-bound traffic? Seems like encryption would terminate on the ASA, but is the MX the gateway for RA-VPN internet bound traffic? Or alternatively do you 1:1 NAT the ASA on the MX?



I ask because the ASA uses firepower to inspect RA-VPN tunnel-all. If one were to rip and replace with Meraki MX advanced sec, the ASA no longer does deep packet inspection on RA-VPN traffic (I want to make sure the MX can inspect the RA-VPN tunnell-all traffic, without keeping Firepower active).

[SteveHemi]

You could use pfSense to provide those Client VPN connections as Cb123 recommended since the ASA is going away. It uses OpenVPN.