Anyconnect VPn

[Shubh3738]

We have configured a group policy and AnyConnect profile for SAP users hosted on AWS Cloud. The cloud setup includes SD-WAN with vmX configured in a VPC.

Current Scenario:
SAP users can access only SAP applications as expected.
Non-SAP users are also able to access SAP applications and other servers, despite policies in AD.
Group policies in AD are not being enforced correctly.
Key Issue:

Documentation states:
"The MX does not support mapping group policies via Active Directory for users connecting through the client VPN."

Given this limitation, how can we achieve the desired policy enforcement to restrict SAP access for non-SAP users while ensuring proper access for SAP users?

Additional Context:
We aim for a solution that enforces group-specific restrictions.

Looking forward to recommendations or workarounds!

[alemabrahao]

AnyConnect on the MX does not support multiple VLANs or address pools for Client VPN users. However, the MX supports the application and enforcement of policies to AnyConnect users on authentication. It is also important to note that, from a Client VPN standpoint on the MX, having users on the same subnet does not mean they are in the same VLAN. Users are assigned a /32 address (one address) from the pool configured on dashboard. Group Policies can then be used to limit users on the same AnyConnect subnet from talking to each other or other resources on the network.

https://documentation.meraki.com/MX/Client_VPN/AnyConnect_on_the_MX_Appliance#Group_Policies_with_RA...

[PhilipDAth]

Attacking this using AnyConnect profiles is the wrong way to go.  Instead have everyone else the same profile, but have the MX enforce different sets of firewall rules.

If you are using RADIUS authentication, then use the Filter-Id atttribute to apply a group policy.

https://documentation.meraki.com/MX/Client_VPN/AnyConnect_on_the_MX_Appliance#Group_Policies_with_RA...

If you are using SAML authentication (such as Entra ID) then push a SAML attribute.

https://community.meraki.com/t5/Security-SD-WAN/AnyConnect-SAML-Group-Policy-assignment/m-p/247512/h...

Then just create a group policy with layer 3 firewall rules for each group saying that they can access.

[Shubh3738]

Sir, Currently iam using fortinet vpn for roaming users, But need to replace it with AnyConnect vpn in this month as renewal is coming on last week on this month .

We are using Active directory for an authentication of users where we create multiple policies for Local Lan users, Critical Application users and so on.

By this if user need Critical application access only, they are not authorized to access Local Servers or Services.

Is there any other way to achieve solution like this. As we have on AD for authentication  only.

We have also vmX installed in AWS Cloud. If possible, by configure AnyConnect on vmX , we can check that scenario also.

[PhilipDAth]

Add the Windows Role "Microsoft NPS Server".  It is a RADIUS server that comes with Windows Server.  Use that for authentication.

[Shubh3738]

For Application control ? 

My use cases- 

1. Let us assume we have 4 types of vpn users. User 1, User2, User3, User4.

a.) User A - need to access only GUI Based application hosted on cloud.

b.) User B - need to access only NAS server hosted on DC

c) User C - need to access only Web based application hosted on Private Cloud

d.) User D- need to access All Application or Servers hosted on DC, Cloud so on...

Let me explain our connectivity- 

• In DC we have MX 450
• In Private Cloud- Have MX 64
• In AWS Cloud - we have vmX
• In approx. 50 Project site location- have MX 64

All in SD-WAN ( Auto VPN) connectivity.

Explaining Current VPN scenerio-

- Have Fortigate Firewall- only for Forticlient VPN

-Have Active Directoory - used for maping group policy and Authenticatio of users. ( All 4-5 groups created and mapped with Fortigate for user authentication and mapping the group policies).

After connected the VPN, users can access services as per given access of that policy group only.