Option for MFA When Connecting to Meraki Client VPN?

[eanderson]

Hello,

I apologize if there is an answer for this out there that I am missing, and chances are it's fairly obvious, though I am new to Meraki networking. I am wondering if it is possible to implement MFA for users connecting to the Meraki Client VPN via Cisco AnyConnect? 

Currently we use a RADIUS server for authentication. If it is possible to deploy this, I am wondering what that process would look like to be able to do so, if there is any documentation or simply an answer someone could provide to help point me in the right direction, it would be much appreciated.

Thank you! 😁

[Obrez]

Hello, yes, it is totally possible.  First, you will need to contact support and have them enable SAML auth for anyconnect.  We use Azure MFA, and it is very straight forward using enterprise app for anyconnect.  Let me know if you have questions.

cheers!

[KarstenI · Accepted solution]

Another option to the mentioned SAML to Azure is SAML to Duo which is my preferred option, or RADIUS to an internal Duo authentication proxy that authenticates through LDAP and then queries the duo cloud to send the push to the users phone.

[eanderson]

Thank you for the response! Would you happen to know if the combo for RADIUS to AD FS is available as well? Per the Meraki documentation I see SAML to AD FS is, but unsure if RADIUS is as well.

Thanks again!

[Obrez]

You can use Microsoft's NPS to Entra MFA plugin on your NPS server.  We are currently using this at one of our sites because we have many contractors we need to apply firewall rules to (using filter ID).  It has been working well.

you can find info here:  Use Microsoft Entra multifactor authentication with NPS - Microsoft Entra ID | Microsoft Learn 

[Obrez]

I forgot to mention, if you are using your current NPS for authentications that you don't want MFA for, you will have to build another exclusive NPS server just for MFA.  It's all or nothing unfortunately.  Let me know if you have questions.

[Darren88a]

Hi, would you have any details on setting this up.. I would like to configure this for a deployment, Meraki Anyconnect VPN >  Duo / Entra ID

[KarstenI]

Start here:

https://documentation.meraki.com/MX/Client_VPN/AnyConnect_on_the_MX_Appliance/Authentication#SAML_Au...

https://duo.com/docs/sso-meraki-secure-client