(fixed, see edit) We currently use Meraki MX64 client VPN in combination with a local Windows NPS server (radius) so that users can authenticate with their Windows credentials. This works fine but I want to protect the connections with MFA, so I installed the 'NPS Extension for Azure MFA' on the NPS server. Unfortunately I cannot get that to work in combination with our client-VPN. When having it enabled, users cannot establish a VPN connection anymore. They are able to enter their user/pass when the Windows VPN client asks for it but after that it just times out without the user being prompted for MFA: The NPS server logs the following on these connection attempts: "NPS Extension for Azure MFA: NPS Extension for Azure MFA only performs Secondary Auth for Radius requests in AccessAccept State. Request received for User testuser1@exampledomain.com with response state Discard, ignoring request." "NPS Extension for Azure MFA: NPS AuthN extension bypassed for User testuser1@exampledomain.com with response state Discard" I have ran the Azure MFA NPS health check script and that shows no issues. The testuser also has a valid Entra ID P1 subscription. Further more, the users are able to use MFA on Microsoft services. The settings I'm using on the NPS server are the working settings that were already in place for the non-MFA client-VPN as described in this article: https://documentation.meraki.com/MX/Client_VPN/Configuring_RADIUS_Authentication_with_Client_VPN_IPsec I also have set the radius timeout in the Meraki dashboard to 180 but that doesn't make a difference. I'm having the feeling that it might just be a simple setting in my NPS server that can fix the problems. Can anyone that also uses that NPS Extension for Azure MFA on their NPS server share their settings? Or does anyone have any advice on how I could possibly fix my issues? note: I know Anyconnect can do MFA flawlessly with SAML but Anyconnect is not an option for us. Thanks in advance EDIT: Nvm, i fixed it. Turns out I erroneously swapped around two registry key values earlier when I was troubleshooting the early stages 😑 Hitting myself with a hammer in the head. Btw, now that it's working, I can confirm that using the starter radius settings from the Meraki article from above, are enough to get it working in combination with the extra NPS extension (this is something I was wondering about a lot during my earlier troubleshooting). ... View more

We have a MX64 configured with L2TP client VPN.   In MX64 > Network-wide > Eventlog > VPN client connected, you can see when a VPN client connected to the MX64. Amongst other things, you'll see a MAC address in the column "Client". All these addresses start with "03:" in my MX64. What MAC address is this? It's not the MAC address of the remote client computer and also not of the remote client's computer router/modem. My best guess is that it might belong to the remote client's VPN adapter/WAN miniport but I'm not really sure. I couldn't retrieve the MAC address of the VPN adapter/WAN miniport by trying standard methods on the remote client PC (ipconfig /all, powershell, wmi).   I'm kinda disappointed the eventlog doesn't appear to show the remote client's MAC address and thus making identification of physical remote devices impossible, unless I am overlooking something? Does anyone know what these MAC addresses are? ... View more

Hardware: MX64   I'm working on a project to restrict access with help of a splash page and I'm still in the testing phase. Therefor I have configured a splash page on a specific VLAN in: Security & SD-WAN > Access control > Sign-on with my RADIUS server and this seems to work so far but I need to take it further and for testing purposes I need to undo access given to a account/IP address that signed in through the splash page. How do I this? I've tried disabling/re-enabling the splash page for that VLAN but that doesn't make a difference because when I access that particular VLAN now, I'm always granted access now because I successfully signed in earlier.   edit: According to the official documentation, revocation should be available on Network-wide > Monitor > Clients but my setup is a bit different than most of the documentation I read. I'm requesting a web page from a PC on the internet from a web server residing on the local lan of the MX64 through port forwarding with a reverse proxy in between. The route is followed: PC on internet > MX64 port forward to > reverse proxy with splash page on its vlan > web server with its own vlan.   Since the PC is not on the local MX64 LAN and thus not on the client list, I'm unable to revoke and I was wondering if the PC not being on the local posed a problem, but I later found out the proxy is the splash page client and not the PC. However, the revoke button wasn't there on the Meraki client page of the proxy (see screenshot). I've called support and they said that they've seen this before and it's a known issue. Support asked me to disable VLANS temporarily to see if the revoke button still not shows. If that's the case, than they'll escalate it to the dev. team. I now need to find a good moment to disable VLANS (obviously not during production hours). ... View more

In this article: https://documentation.meraki.com/MX/Site-to-site_VPN/Configuring_Site_to_Site_VPN_tunnels_to_Azure_VPN_Gateway  you see Meraki choosing a IPsec policy preset called 'Azure'. This policy does a Phase 2 Lifetime of 3600.   In this article: https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpn-devices at 'IKE Phase 2 (Quick Mode) parameters' you see Azure doing a RouteBased Phase 2 Lifetime of 27000. IPsec policy's are not editable in Azure.   Either the Meraki article or the IPsec template which you select in the Meraki device is incorrect (Phase 2 Lifetime should be 27000 on Meraki's side instead of 3600).   Note: Azure does not support PolicyBased in combination with Meraki so PolicyBased settings are not applicable (see 'Validated VPN devices and device configuration guides' in the Azure article). ... View more

Hi,   Implementing Meraki client VPN atm and all is working fine. Currently in the end stage where I need to deploy the VPN config to the end user laptops running Windows 10. I've tried a few methods but all have their downsides: - GPO-Network option: not able to deploy IPsec pre shared key or configure split tunnel options. - CMAK: Even though UserNameSuffix=domain.tld and UserName=%username% are set in config files, the vpn client doesn't use domain credentials by default and user is required to enter them as opposed to GPO-Network option where the connection automatically uses the domain credentials of a logged in user. Also the client wants to dial in through PTSN by default even though Dialup=1, Direct=1, ConnectionType=1 is set in the config files (can be manually fixed to force permanent connection though). - GPO-Powershell: unable to deploy with required Meraki settings as the script produces the following error: "The current encryption selection requires EAP or MS-CHAPv2 logon security methods." Script: Add-VpnConnection -Name "VPN" -ServerAddress "xxx.xxx.xxx.xxx" -TunnelType "L2tp" -EncryptionLevel "Required" -AuthenticationMethod Pap -UseWinlogonCredential -SplitTunneling -AllUserConnection -RememberCredential -PassThru Ofcourse, I'm able to manually tweak some settings on the user end to make it work but I would to like do it automated since we have a lot of laptops. Anyone else found a better approach? ... View more