We opted for the profile option using the linked profile editor for creation of the .xml file.   It worked like this:   Created a profile with a different name than our already-used webvpn.domain.org, went to Client VPN settings in dashboard and Enabled 'Profile Update' then clicked Choose File and navigated to the location of the saved .xml file, clicked open, then clicked to save in the Meraki dashboard.   Tested by loading a laptop pre-loaded with the Cisco Secure client from an off-network location, opening the client, entering the Meraki DDNS hostname and connecting.  NOTE:  Depending on the secure client settings, you might have to go into those settings and uncheck a Block Untrusted Connections box before completing these steps.   A pop up appeared saying the Certificate was untrusted.  Clicking on "Connect Anyway" allowed the VPN to establish AND auto downloaded the profile for future connections.   Signed off of the VPN, closed Secure Client and reopened it and this time, the server name field was pre-populated with the VPN Name contained in the profile.  Connecting to that VPN Name established the VPN without error.   Definitely the easiest way to accomplish what we needed and more cost effective!   Many thanks to the community and especially @PhilipDAth who didn't appear to get irritated by my many questions. ... View more

Can you verify this is the process & walk through what goes in the blanks on the profile editor?  This sounds easy.   1. Use profile editor link given earlier and download and save a profile file: *VPN name #1: assuming webvpn.domain.org ?? *Hostname/Outside IP address #1:  assuming our outside/public IP of the Meraki device or the Meraki DDNS hostname ? *VPN type #1: Defaults to TLS (IKEv2-Username & IKEv2-Cert also available).  We are using Meraki auth, so username or TLS?   2.  Log into Dashboard and go to Secure Client VPNs, and enable Profile Update, then upload the profile you created and saved and save changes.   Is that it?  What do I do about the CNAME entry in our public DNS?  Leave it pointing the the DDNS hostname, or does it need to be removed?   This method will update their profile on first signon via Secure Client and then Meraki takes care of SSL certificate and my purchased one is no longer needed?   Thanks so much.     ... View more

To be honest, that's what I currently have in place (thinking that would work), but obviously, Meraki picks up on that somehow and returns a certificate error to users that it's not a secure connection.  Right now, they are having to click through a 'connect anyway' prompt.  So, I was hoping that doing the custom certificate setup and having my DNS record put back to an A record pointing to our outside IP would resolve.  But, maybe not?  I frankly was very surprised that the error appeared.  When we tested and manually entered the DDNS name, it worked without error.   Thanks  again for your response.  I'm headed home, so if you reply to this, I'll see it tomorrow. 🙂 ... View more

Sorry for the late reply.  I've been further investigating pros and cons and am still unsure.   1.  I realize that using the DDNS name is easiest.  However, we only have a handful of users already connecting using the Secure client on company issued laptops via the subdomain for a long time now with our old ASA.  The DDNS name is long and hard to remember and I have to retrain users.   2.  We do not have a profile push set up to change that in the profile (which I read about doing), and are using manually created Meraki auth for them to connect so that would be more for me to figure out.   3.  I have an existing SSL cert from godaddy for the subdomain that I can request a re-key for with a CSR from Meraki so I can go through the custom cert process.  The existing cert is valid for some time yet.   Even if it's not typical, the custom certificate option seems the best for us, but I could be wrong.  Pros? Cons? Gotchas?   And per my original question, IF I do that, what and how does this affect my public DNS record?  Still an A record for the subdomain for my outside IP?  Or, a CNAME record to something at Meraki?  Or, no record needed there at all?   Thanks! ... View more

Thanks for the reply.  In order for this to work, will I need to put the public IP in the CSR request as a SubjectAltName?  I watched a YouTube video that showed that's how they did it.  I really would like this to work on the first attempt.  Or, does Meraki automatically send the request to the configured public IP (WAN uplink) on the device?  No warm spare - just a single MX75 for a small network.  Thanks for your help. ... View more