CWA-VPN

[emkn]

Hi

I have a scenario where i want the wireless guest clients to get redirected to the ISE (CWA) in the meraki vpn tunnel and authorize the client to a different vlan and break out the client traffic locally at the MR ? 

Is this possible ? I have tried to do this with Acl name and use group policy but i am struggling to get this to work.

[PhilipDAth]

Never tried it, but this article looks interesting.

https://documentation.meraki.com/MR/Encryption_and_Authentication/Central_Web_Authentication_(CWA)_w...

[PhilipDAth]

This also looks related.

https://community.cisco.com/t5/security-documents/how-to-integrate-meraki-networks-with-ise/ta-p/361...

[jcottage]

I don't believe you can use a group policy to change the "Client IP assignment" mode from VPN to bridge. This is set at the SSID not at the host.

You can however use a group policy to change a vlan and add ACLs to host.