I need to restrict Anyconnect VPN users to only be able to access certain IP addresses

[Shukes]

Hi

I need to restrict access for users that connect using the Anyconnect VPN to only IP addresses on the network that are critical

Can I restrict by AD group membership

If so is there a good document on how to set it up

Thanks

Chris

[alemabrahao]

You can use Layer 3 firewall rules on the Meraki MX to restrict Client VPN users' access to only specific subnets or IP addresses.

https://documentation.meraki.com/MX/Client_VPN/Restricting_Client_VPN_access_using_Layer_3_firewall_...

[alemabrahao]

You can also use Group policy to restrict, but not to a specific group, only to all users who connect to the VPN.

[cmr]

Oh wow, I never realised that the Meraki client VPN didn't have conditional access for client VPN users!  Isn't that one of the most common route to data breaches, when people have overly generous remote access?

[PhilipDAth]

If you are using RADIUS authentication, you can use the Filter-Id attribute.

https://documentation.meraki.com/MX/Client_VPN/AnyConnect_on_the_MX_Appliance#Group_Policies_with_RA...

If you are using SAML authentication, then you can pass a group.  I did a post about doing this ages ago.  You no longer need to email anyone.

https://community.meraki.com/t5/Security-SD-WAN/AnyConnect-SAML-Group-Policy-assignment/m-p/245425/h...

You can also manually apply a group policy to a user once they have connected and you can see them.  The policy sticks for future VPN connections.

[cmr]

I did think that it had to be possible!

[rhbirkelund]

I see that Philip cut me to the chase, as always! 😄

[Shukes]

Hi Phillip ,your answer looks the closest to what we want .  We are using RADIUS with anyconnect and also DUO MFA.   Does this Filter ID only allow us to just use the same policy for everyone on the VPN  .  How can I assign some VPN users to  groups that then  allow different policies on the meraki to control access based on the group.  The documentation just appears to allow you set one for the filter ID attribute.  I may be missing something on how to do this  Thanks Chris

[rhbirkelund]

You can open a case with Meraki Support, and have them enable SAML Authentication with Group Policy for Anyconnect.

Then you can create Group Policies and assign them to users, per group membership in Entra ID (or other Cloud AD that supports SAML). 

In the Group Policy you would then define L3 ACLs which would allow or deny access to specific IP addresses or subnets.