I see we have a number of people looking at this old thread.   Since this was originally posted a new method is now available.  You can now configure certificate with username+password authentication with RADIUS. https://documentation.meraki.com/MX/Client_VPN/AnyConnect_on_the_MX_Appliance/Authentication#Certificate-based_authentication_with_Username_.26_password   You setup an Enterprise CA, and issue every machine with a certificate.  Meraki+AnyConnect will first check that the machine has been issued a certificate, and then check the users username and password.   You can also use AnyConnect+SAML+Duo, and use Duo device trust to verifify the computer is a member of AD or manually trusted. https://documentation.meraki.com/MX/Client_VPN/AnyConnect_on_the_MX_Appliance/Authentication#SAML_Authentication    https://duo.com/docs/trusted-endpoints   ... View more

If you are using RADIUS or AD Authentication - no.   If you use SAML, and your SAML provider supports changing the password - yes.  I use SAML for 99% of my AnyConnect deployments these days.   Cisco Duo can do it (if enabled): https://help.duo.com/s/article/5797?language=en_US Azure AD can do it (it enabled): https://learn.microsoft.com/en-us/azure/active-directory/authentication/tutorial-enable-sspr I don't know about other SAML providers.  These are the two I do.   Duo is 100 times simpler. ... View more

@e39_540i does it actually allow them to connect when they are behind the MX, or is the MX in one armed concentrator mode? ... View more

Hey just a heads up, I went back and cleaned this up and removed syslog-ng altogether as I didn't want to have to maintain a different application just to collect the Meraki logs. I might re-install it if I need to push other logs to this server but for the time being, I'm only sending Cisco FP and Meraki logs.    In order to do this, I downloaded and installed the Sumo Logic Installed Collector on my Linux server. With the collector installed, you simply need to configure the sources (your Meraki devices) in the Sumo Logic dashboard with the corresponding IP and port numbers.   Use these docs to get things going: 1. https://help.sumologic.com/07Sumo-Logic-Apps/22Security_and_Threat_Detection/Cisco_Meraki/Collect_logs_for_the_Cisco_Meraki_App   2. https://help.sumologic.com/03Send-Data/Sources/01Sources-for-Installed-Collectors/Syslog-Source From this article, this was the important piece for me --    For multiple syslog collections, set up a separate Source for each and set a separate port number for each.   Hope that helps. I'm now able to ingest the Meraki logs without configuring a whole bunch of overhead for syslog-ng. ... View more

Just wanted to reference to this "UserVoice" idea which is that Intune should support configuring VPN w. L2TP-PSK / PAP; https://microsoftintune.uservoice.com/forums/291681-ideas/suggestions/41712955-enhanced-l2tp-configuration-profiles-for-windows Please upvote that if you are using Intune and want to easier be able to manage MerakiVPN. ... View more

Just following up to provide some snippets of my actual config file, here's how I have it configured (generalized for privacy). Also, if there's any way to clean this all up, any input is much appreciated. I am a novice with Linux and even more-so with syslog-ng.     #define syslog source -- a.b.c.d in this section referring to the syslog server. #source s_net { udp(ip(0.0.0.0) port(514)); }; #source s_net { tcp(ip(0.0.0.0) port(514) max-connections (5000)); udp(); }; source s_net { udp(ip(a.b.c.d) port(514)); }; source s_meraki_flfw { udp(ip(a.b.c.d) port (514)); }; source s_meraki_cafw { udp(ip(a.b.c.d) port (514)); }; source s_meraki_cofw { udp(ip(a.b.c.d) port (514)); }; source s_meraki_gafw { udp(ip(a.b.c.d) port (514)); }; source s_meraki_mnfw { udp(ip(a.b.c.d) port (514)); };   #filtering filter f_meraki_vmx100_urls { host(x.x.x.x) and match("urls" value ("MESSAGE")); }; filter f_meraki_vmx100_flows { host(x.x.x.x) and match("flows" value ("MESSAGE")); }; filter f_meraki_flfw_flows { host(x.x.x.x) and match("flows" value ("MESSAGE")); }; filter f_meraki_flfw_urls { host(x.x.x.x) and match("urls" value ("MESSAGE")); }; filter f_meraki_cafw_flows { host(x.x.x.x) and match("flows" value ("MESSAGE")); }; filter f_meraki_cafw_urls { host(x.x.x.x) and match("urls" value ("MESSAGE")); }; filter f_meraki_cofw_flows { host(x.x.x.x) and match("flows" value ("MESSAGE")); }; filter f_meraki_cofw_urls { host(x.x.x.x) and match("urls" value ("MESSAGE")); }; filter f_meraki_gafw_flows { host(x.x.x.x) and match("flows" value ("MESSAGE")); }; filter f_meraki_gafw_urls { host(x.x.x.x) and match("urls" value ("MESSAGE")); }; filter f_meraki_mnfw_flows { host(x.x.x.x) and match("flows" value ("MESSAGE")); }; filter f_meraki_mnfw_urls { host(x.x.x.x) and match("urls" value ("MESSAGE")); };   #destination files destination df_meraki_vmx100_urls { file("/var/log/meraki_urls.log"); }; destination df_meraki_vmx100_flows { file("/var/log/meraki_flows.log"); }; destination meraki_flfw_flows {file("/var/log/firewalls/meraki/flfw/mx_flows.log"); }; destination meraki_flfw_urls {file("/var/log/firewalls/meraki/flfw/mx_urls.log"); }; destination meraki_cafw_flows {file("/var/log/firewalls/meraki/cafw/mx_flows.log"); }; destination meraki_cafw_urls {file("/var/log/firewalls/meraki/cafw/mx_urls.log"); }; destination meraki_cofw_flows {file("/var/log/firewalls/meraki/cofw/mx_flows.log"); }; destination meraki_cofw_urls {file("/var/log/firewalls/meraki/cofw/mx_urls.log"); }; destination meraki_gafw_flows {file("/var/log/firewalls/meraki/gafw/mx_flows.log"); }; destination meraki_gafw_urls {file("/var/log/firewalls/meraki/gafw/mx_urls.log"); }; destination meraki_mnfw_flows {file("/var/log/firewalls/meraki/mnfw/mx_flows.log"); }; destination meraki_mnfw_urls {file("/var/log/firewalls/meraki/mnfw/mx_urls.log"); };   #bundle source, filter & destination rules log { source ( s_net ); filter( f_meraki_vmx100_urls ); destination ( df_meraki_vmx100_urls ); }; log { source ( s_net ); filter( f_meraki_vmx100_flows ); destination ( df_meraki_vmx100_flows ); }; log { source ( s_meraki_flfw); filter( f_meraki_flfw_flows); destination ( meraki_flfw_flows ); }; log { source ( s_meraki_flfw); filter( f_meraki_flfw_urls); destination ( meraki_flfw_urls ); }; log { source ( s_meraki_cafw); filter( f_meraki_cafw_flows); destination ( meraki_cafw_flows ); }; log { source ( s_meraki_cafw); filter( f_meraki_cafw_urls); destination ( meraki_cafw_urls ); }; log { source ( s_meraki_cofw); filter( f_meraki_cofw_flows); destination ( meraki_cofw_flows ); }; log { source ( s_meraki_cofw); filter( f_meraki_cofw_urls); destination ( meraki_cofw_urls ); }; log { source ( s_meraki_gafw); filter( f_meraki_gafw_flows); destination ( meraki_gafw_flows ); }; log { source ( s_meraki_gafw); filter( f_meraki_gafw_urls); destination ( meraki_gafw_urls ); }; log { source ( s_meraki_mnfw); filter( f_meraki_mnfw_flows); destination ( meraki_mnfw_flows ); }; log { source ( s_meraki_mnfw); filter( f_meraki_mnfw_urls); destination ( meraki_mnfw_urls ); }; ... View more

We contacted MAXMIND...Have to use the chat feature and they will be updating their records accordingly from the last I text them.....   My chat session with MAXMIND:   Paul: Okay, it looks like Google was using some of the IP addresses near those for Mexican traffic, which is probably why the range including those DNS addresses was moved there. We should have the DNS addresses back in the US in next week's update. Bobby: To confirm the update should happen this weekend? Paul: Our databases update weekly on Tuesdays. Bobby: Ok...to confirm the updates you are performing? Paul: The DNS addresses should be moved back to the US. Not sure if they'll be listing them in Mountain View, CA specifically or just "US" on a country level only. ... View more

From the VPN Status page, right around the time this was happening between the two offices. However, the peer that is listed isn't one of the two offices that fired off the alerts. ... View more