VPN Concentrator for Client VPN

[LRH]

I would like to setup an MX100 in VPN Concentrator mode....but...only use it for my client VPN users to connect to.

I have read the deployment guide for the vpn concentrator and it appears as if that is for site-site connections.

Can I setup a MX to ONLY terminate client VPN connections?

[Welles]

You got it. Server to Server ... i.e. MX to MX or another “device” that is not a client(as in mobile device, i.e. cell phone). 

I think people *have* setup IPsec tunnels manually, but that’s another story.  

[PhilipDAth]

I just tried enabling Client VPN for an MX in VPN Concentrator mode and it took the config just fine.

[Welles]

I stand corrected. I thought all that was pulled.

Here’s a doc outlining setup details.

https://documentation.meraki.com/MX/Client_VPN/Client_VPN_OS_Configuration

[LRH]

I don't want the MX to participate in any site-site tunnels.....just the client vpn terminations....

According to the directions that isn't possible in concentrator mode.....have to use NAT mode with two cables...

[LukasB]

I am facing exactly same challenge. Need to setup MX100 only for serving VPN client connections as an one armed VPN concentrator. 

According to Meraki guides it it only possible for site-site tunnels. Anyway I plan to test these in the nearest feature.

Overall Is it possible to configure it?

[Ignat]

For those who are looking for a straight answer to this question, yes, client VPN will work if MX appliance configured to be a One-Arm Concentrator. I just configured one and it is working as intended. 

[RichardChen1]

@Ignat  thanks for the update. Since the concentrator has a lan ip address. What kind of port forwarding required for client vpn to work? Just udp500/4500 to lan ip?

[Farooq]

I am facing same issues setting up mx as a concentrator and only for client vpn. Any updates from anyone on this please

[KarstenI]

---

@RichardChen1 wrote:

Since the concentrator has a lan ip address. What kind of port forwarding required for client vpn to work? Just udp500/4500 to lan ip?

---

Yes, UDP/500 and UDP/4500 is enough as with NAT-T, after the initial exchanges on UDP/500 all is encapsulated in UDP/4500.