Duo MFA for Meraki Cloud Authenticated users?

[WarrenG]

Is it possible to use Duo to require MFA for Meraki Cloud Authenticated users while using Meraki Client VPN? Specifically we need to use the AnyConnect option with Meraki Cloud Authenticated users, but need to be able to protect that connection further with MFA. Is this scenario possible?

[Inderdeep]

@WarrenG Check this one out may help 

https://documentation.meraki.com/General_Administration/Other_Topics/Two-Factor_Authentication 

[WarrenG]

So the answer is no then?

[PhilipDAth · Accepted solution]

No.

You could use AnyConnect and Duo, and authenticate against Office 365.  I would use this option.

You could use a machine running inside of the network running the Duo Auth proxy and configure the MX to do RADIUS against it, and have the auth proxy configured to do MFA only.

This would result in the username+MFA being used, but the password being ignored.

[WarrenG]

Thanks PhilipDAth. If the answer to my question is no, then that's what I was looking for. I know about the other options, but they are not viable for what I'm needing in this specific case.

[JRSac]

So, did you ever get this to work? I would like to do the same - use Meraki cloud authenticated users and an MFA like duo without having to install and maintain a proxy server.

[WarrenG]

No, we ended up going with what I think was a better option for us i.e. authenticating against Microsoft 365 user accounts instead of Meraki cloud user accounts. The benefit of this option is that we can leverage Microsoft's built in MFA as opposed to needing a separate third-party option like Duo.

[JRSac]

Thank you. I will try to research how to do that. We have Microsoft 365 and would need to restrict to a VPN user group.

[WarrenG]

The link below should be helpful if that's the way you plan to go. It's pretty slick once you have it up and running 👍

https://documentation.meraki.com/MX/Client_VPN/AnyConnect_on_the_MX_Appliance/AnyConnect_Azure_AD_SA...

[JRSac]

Thank you. If I can ask, which type of two factor are you using for the client authentication?

[WarrenG]

Yep, we use the two factor authentication that's built into Microsoft 365. You should have MFA enabled for all your users already, but you can also add it as specific requirement for the VPN connections via a conditional access policy that targets the VPN application that you will create in Entra.