Anyconnect on Meraki MX

[Naresh_Pattu]

Hi,

My client is currently using MX95 along with Secureclient "Advantage" subscription.

Currently he is adding the VPN users manually and now he wants to restrict the VPN users with MAC ID.

He feels that if any of the users tries to connect from personal device with his anyconnect , it should be blocked.

Is there any workaround for this?

[MartinLL]

You would need some sort of device compliancy check. Not possible to do nativly in the dashboard.

What you could do is configure a radius service, ISE for example to get compliancy status as part of the authz sequense and grant acces based on that.

You could also do SAML to for example Entra ID. There you can controll access by defining policy in Conditional access.

Either way MAC filtering would not be a good solution even if it could be done.

[Naresh_Pattu]

Hi Martin,

Thanks for your response.

Would be great if you can share more details on Entra ID, how to implement it with Meraki.

[MartinLL]

Sure. Here and here. 

https://documentation.meraki.com/MX/Client_VPN/AnyConnect_on_the_MX_Appliance/AnyConnect_Azure_AD_SA... 

https://learn.microsoft.com/en-us/entra/identity/conditional-access/overview 

[Naresh_Pattu]

Thanks Martin for the quick support.

Will check this and update here.

[PhilipDAth]

@MartinLL is onto to it.  This is something you would enforce in your IDP, such as Entra ID, Duo, etc.  This is exactly how I do it for our company (using Duo).  We strict VPN access to company owned machines.

It likes it might be possible to do this using certificates as well.  You would deploy a certificate onto the machine you want to allow.  And then you create an "Remote Access - VPN Posture" configuration that requires a certificate.

https://documentation.meraki.com/CiscoPlusSecureConnect/Cisco__Secure_Connect_Now_Remote_Access/Remo...

This is under Secure Connect/Endpoint Posture/VPN Access.