Setting up Cisco Meraki Client VPN with NPS & AzureMFA extension

[thaack]

I recently went through the process of setting up RADIUS auth for Meraki's IPsec Client VPN, so I could utilize the NPS AzureMFA extension for MFA as our users are already set up on Microsoft Authenticator for M365. I decided to go this route as opposed to AnyConnect as AnyConnect is still not supported on Network Templates and the security risks associated with SSL VPNs.

This turned out to be a huge headache as the Meraki Documentation on the RADIUS NPS setup is a bit outdated and the Microsoft documentation on the AzureMFA extension for NPS can be misleading when working with Meraki Client VPN and the Windows built in VPN client.

Hopefully my writeup below saves some people some time if they decide to go this route:

Setting Up Azure MFA with NPS for Meraki Client VPN (And Everything That Can Go Wrong) 

[PhilipDAth]

Well done.  It is a big pain!!!

I won't do NPS with Azure MFA deployments anymore.  I keep having them break every year or two, and they are really hard to debug.

I think if I couldn't do AnyConnect because of the templates, I would use something like Cisco Secure Access or Cisco SecureConnect - where users VPN into a Cisco cloud head end, and then use AutoVPN to get back to what they need to connect to.

[thaack]

Thanks for the heads up.

Assuming SecureConnect is still subscription per user based it would be a significant cost 😥

[PhilipDAth]

It is per user.  Cisco Secure Access is quite a bit cheaper, but has a minimum order quantity of 100 users.

[Brash]

Nice writeup!

I've never liked the NPS Azure MFA integration.

We tried getting it integrated with MS AOVPN and had all sorts of issues.
Looks like NPS + Azure MFA + Meraki native client is even more difficult.

One of the issues we hit was that the MFA prompt would appear behind all of the user's other applications on the client PC. Not super helpful for staff with limited computer literacy 😆