Register or Sign in
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About Phil_SCDS
Phil_SCDS
Getting noticed
Member since May 21, 2019
03-31-2023
Community Record
23
Posts
5
Kudos
1
Solution
Badges
03-31-2023
04:40 AM
4 Kudos
I played around a bit more and figured it out (always the way just after you decide to post on a forum). Basically you have to register each AnyConnect instance as a separate enterprise app in Azure. Under Organisation -> Settings -> Authentication on the dashboard you can configure multiple SAML providers. I did this and made sure the correct meta data for each was uploaded to the AnyConnect config on the correct MX and it now works.
... View more
03-31-2023
02:56 AM
Hi All, I have multiple sites configured using various models of MX routers. At one site (lets call it base site) we have AnyConnect set up and working with the MX and using Azure as the IDP. It works a charm. However, I do not like relying on the internet connection of a single site for our increasingly heavy remote working requirements. I want to set up another one of our sites (lets call it second site) to also use AnyConnect and then enabled load balancing and backup servers. Meraki only allows you to register AnyConnect once as an enterprise app in Azure but Azure can configure up to 256 identifiers and reply URLs per registration. The behaviour I find when trying to connect to the second site is the following: My browser sets up a TCP session with the second site MX, the second site MX then replies with the info to contact the IDP (Azure). Browser the sets up and TCP session with Azure and I am prompted to enter my credentials. As soon as I enter my credentials I notice my browser is now communicating with the base site MX, and the connection ultimately fails. After some research I have found that Azure will always reply to a SAML request with the default reply URL unless the specific reply URL is defined in the original SAML authentication request sent to Azure. After speaking with Meraki support they have told me that I am butting up against a limit of the MX but I am still not certain given that there are 2 different MXs here. My only thought is that the SAML request sent to Azure after the initial communication with the MX simply does not include the reply URL and so Azure just replies with the default. This seems like a massive short coming as it means that each Meraki tenant can only have a single AnyConnect setup enabled regardless of the size of the tenant. Any help would be greatly appreciated. Phil
... View more
Labels:
- Labels:
-
Azure
-
Client VPN
07-21-2022
02:41 AM
1 Kudo
Both PhilipDAth and AaronDo were correct, I needed to test it from outside my MX and I had forgotten to add teh custome port. Thank you both for you help.
... View more
07-15-2022
04:34 AM
I am attempting to enable SSO for Cisco AnyConnect through Meraki using Azure AD as the Ipd. I am following this guide: AnyConnect Azure AD SAML Configuration - Cisco Meraki Which in step 7 says to set these two values in Azure like this: If my AnyConnect Server URL is "vtk-qpjgjhmpdh.dynamic-m.com", the Entity ID and Reply URL will be configured as follows: a. Identifier (Entity ID) - https://vtk-qpjgjhmpdh.dynamic-m.com/saml/sp/metadata/SAML b. Reply URL (Assertion Consumer Service URL) - https://vtk-qpjgjhmpdh.dynamic-m.com/saml/sp/acs When I test the SSO in Azure it gets pass the Azure authentication and it attempts to load the Reply URL above but I get an error 404 message. This guide from Microsoft: Tutorial: Azure Active Directory single sign-on (SSO) integration with Cisco AnyConnect - Microsoft Entra | Microsoft Docs Gives slightly different information about what the identifier and Reply URL should be but I am still unable to get the test to work correctly. Any guidance on this would be greatly appreciated. Many thanks, Phil
... View more
Labels:
- Labels:
-
Azure
-
Client VPN
02-24-2020
08:52 AM
@Charlie Unfortunately the short answer is no. I believe it would be possible with another layer 3 device which you could use to essentially split the traffic into what you wanted to go over the auto VPN and what don't want to. I haven't tested this yet but it is something we are considering doing. I have also used the "make a wish" button to hopefully make Meraki aware that this would be a useful function. If you and others can do that too then maybe it will be available in a future firmware update. Currently we have left it as all traffic going over the auto VPN which of course slows down the remote site but in my case not enough for it to be a huge issue.
... View more
06-28-2019
06:36 AM
Hi BrechtSchamp, I can't configure the connection myself so I only have the end users word that they have followed the instructions. I will ask them to check again though. Many thanks, Phil
... View more
06-28-2019
06:34 AM
Hi SoCalRacer, I will double check on the windows version type, they tend to take a while to get back to me so watch this space. Many thanks, Phil
... View more
06-28-2019
06:32 AM
Hi Nash, I don't have access to the machine in question, I can only pass on instructions and hope for the best. I don't believe there is more than 1 username on the machine in question. I can connect to the vpn using their credentials. Many thanks, Phil
... View more
06-28-2019
06:31 AM
Hi Uberseehandel, Thanks for your reply, unfortunately the machine belongs to the end user and is outside of my remit. Many thanks, Phil
... View more
06-27-2019
08:11 AM
Hi All, I have setup a client VPN connecting into an MX84 router. For the majority of users this is working absolutely fine. However, one user running windows 7 is experiencing error 741 when trying to connect. This is the error for their computer not supporting the data encryption type. My question is: what is the data encryption type. This page: https://documentation.meraki.com/MX/Client_VPN/Client_VPN_Overview Suggests that it is using 3DES, AES128 and SHA1 but SHA1 is no longer supported by Microsoft so it seems unlikely that this is still in use. Does anyone know if this is still correct or if it has changed and the documentation is simply out of date? If so what is the current encryption type? Many thanks, Phil
... View more
06-06-2019
08:21 AM
SoCalRacer, Thank you that was it, there was a random layer 3 wireless firewall rule blocking access to the local LAN. Must be a default policy because I hadn't set it. Thanks again, Phil
... View more
06-06-2019
01:33 AM
Hi rbnielsen, DHCP is running on a windows server, the WiFi clients get an IP address from this server fine. I have tried changing the port the AP is connected to in access of trunk mode. I have tried turning VLAN tagging on but I wasn't too sure which VLAN(s) to add to it - should it be the client VLAN, the server VLAN or both? Many thanks, Phil
... View more
06-05-2019
08:55 AM
Out of interest is the cisco WiFi also 5GHz, have you tried forcing the Meraki to only broadcast 2.4GHz and see if it is any better? Also I assume you have used a channel scanning piece of software to see if there is anything using the same channels that might possibly interrupt your connection (grasping at straws I know)?
... View more
06-05-2019
08:48 AM
I have done this before with MR16s, MR18s and MR20s. It works fine. Access points in general are somewhat directional so with them pointing at the floor you probably will not get the best coverage, however if it is your only option and you have enough points to cover the area needed then it will work. Phil
... View more
06-05-2019
08:45 AM
Hi All, I have a network setup where there are 2 VLANs. The servers are on 118 and the clients are on 128. The server ports on the MS120 are set to trunk mode and all the other ports are access on 128. Clients connected directly into the switch work fine. I have a single MR20 that is broadcasting an SSID in bridge mode. I can connect to the WiFi network fine and I am even getting an IP address from the server on VLAN 118 (so DHCP is working). However if I try to ping the server address or the domain name I get: REPLY FROM 10.128.128.128: destination net unreachable. Any ideas as to how I make the wireless clients communicate with the network properly? The router on this network is an MX84 which relays DHCP requests to the server on VLAN 118.
... View more
05-22-2019
12:43 AM
Hi Sascha, Thanks for trying, I did see the same conclusion on a different forum but your explanation is much clearer, thank you for taking the time. Phil
... View more
05-21-2019
08:36 AM
Hi el_pajaro_bobo, Thank you so much for all your help. This really helping to clear things up. In my case the addresses that the spoke site (mx68) is trying to reach are internet addresses not local networks. The hub site has an NHS broadband connection and the addresses are only available via this. On the mx84 there are traffic shaping rules to make sure that clients trying to access the NHS services use the NHS broadband (wan2 in this case). I would assume from your instructions that I could create a static route on the spoke (mx68) saying NHS traffic go to the mx84. However if I enter an internal IP address of the mx84 into the static route on the spoke router then it says the next hop address is invalid. Can I create static routes to the other MXs inside the auto vpn, or does this need to be done from the destination router so the mx84 in this case? Thanks again, Phil
... View more
05-21-2019
07:19 AM
I think I worked out what you mean by "VPN marker". When I try to add a vlan for the destination network it wants me to add an ip for the mx, the router doesn't have an ip on this range so I am unsure what I should add. Thanks for your time.
... View more
05-21-2019
07:03 AM
Also, I assume I am adding the subnets from the spoke site (MX68) to the subnets section under addressing and vlans?
... View more
05-21-2019
07:01 AM
Hi el_pajaro_bobo, This sounds promising, I shall give this a go and report back. Could you clarify what you mean by "VPN marker"? Many thanks, Phil
... View more
05-21-2019
06:27 AM
Hi MarcP, Thanks for your reply. Flow preferences seem to only allow you to select wan 1 or wan 2 as the route for the traffic. I can't see a way to say specific traffic only uses the VPN. Unless I am missing something. The screen shot below shows that the preferred uplink is only wan1 or wan2. If there was an option there for vpn then I think it would work.
... View more
05-21-2019
04:26 AM
Hello, I have 2 sites connected to each other currently using the auto-vpn functionality. The Hub is running an MX84 and the Spoke an MX68. Due to the nature of the internet usage some traffic has to be routed to the hub site while the rest is normal internet usage. Currently I have it set up at the spoke site to use the hub as a default route as I cannot seem to route traffic destined for specific IP addresses only through the VPN. The issue with this is that all internet traffic is sent over the VPN and it has cut download speeds in half. Ideally I want to set up routes for traffic that is only trying to reach specific IP addresses to be sent to the hub site. I understand that this might not be possible with the auto-vpn and that I may have to set up a site to site vpn manually. I am happy to do this if it solves my issue but I need to know how to set up the static routes once the non-meraki site-to-site vpn is in place. Thanks
... View more
My Accepted Solutions
| Subject | Views | Posted |
|---|---|---|
| 318 | 03-31-2023 04:40 AM |
My Top Kudoed Posts
| Subject | Kudos | Views |
|---|---|---|
| 4 | 318 | |
| 1 | 883 |
