Meraki

Gary_Geihsler1 · ‎Sep 23 2024

Is this question specific to the product Secure Connect or are you trying to create VPN to the MX itself? This community is specific to Secure Connect so if the question is for client VPN to the MX you would have better results in the MX Community.

Gary_Geihsler1 · ‎Sep 4 2024

Multi-factor Authentication is not included in Secure Connect licensing, we have an open system that can support multiple SAML 2.0 MFA providers. If you would like MFA (highly recommended) you would purchase your MFA solution separately. Secure Client is the new major version of AnyConnect. At AnyConnect version 5.0 (now rebranded as Secure Client) there was a major change that allowed Cisco Endpoint Security Agent to be installed as a single software client with Secure Client (on Windows only). Additional modules have been added to Secure Client such as ThousandEyes and ZTNA. The end goal is to have a single software client and child modules that fit specific use cases. Licenses for Secure Connect are calculated on a per named user basis. We have a user defined also as 20GB of data processed per user per month in aggregate. There are some non-standard scenarios where per-user calculations are challenging (retail, industrial) and we have guidance posted for Cisco internal and partners how to quote for those scenarios.

Gary_Geihsler1 · ‎Sep 3 2024

The process does work for NFR, we have dozens of partners with NFR licensing. Work with your Partner Account Manager if there are issues.

Gary_Geihsler1 · ‎Sep 3 2024

Any Cisco Account Manager or Solutions Engineer can start a Secure Connect trial. The process is laid out on the internal version of the SalesConnect site. The document is titled "Requesting a Secure Connect Trial". NFR is the same process as any other NFR product. https://salesconnect.cisco.com/sc/s/simple-media?vtui__mediaId=a1m8c00000niSNZAA2

Gary_Geihsler1 · ‎Sep 2 2024

Trials of Secure Connect are available for customers, currently only Cisco employees can initiate a trial. Partner initiated trials are being worked on. NFR purchases for partners are available for internal/lab use. For quoting with customers that already have Umbrella, you should follow the partner facing ordering guide. You would create a change/modify quote in CCW and the existing Umbrella org is automatically provisioned at time of purchase. If you do not follow the change/modify process we can fix the issue but it takes extra work with your Cisco team.

Gary_Geihsler1 · ‎Aug 30 2024

Secure Connect is managed in the Meraki dashboard. partners have access to the Secure Connect v2 instant Demo in dcloud. There are other resources available to partners on SalesConnect. Do these satisfy what you are looking for?

Gary_Geihsler1 · ‎Aug 21 2024

Currently the client-based ZTNA will always intercept traffic for destinations identified as client-based ZTNA traffic. There is no concept of Trusted Network in client-ZTNA yet.

Gary_Geihsler1 · ‎Aug 19 2024

Secure Connect now offers client-based ZTNA. Client-based ZTNA is included in the Secure Connect Complete Essentials and Secure Connect Complete Advantage packages. Always-on VPN is not supported in Secure Connect at all at this time.

Gary_Geihsler1 · ‎Aug 16 2024

Are you seeing this issue with users on remote access VPN or behind a Secure Connect protected site or both?

Gary_Geihsler1 · ‎Aug 13 2024

How Duo operates is a question for the Duo folks. I have some limited knowledge and Duo optional has the requirement to do an enhanced MFA where a code is displayed on your computer screen and you have to type that code in on your phone. For scenarios outside of Secure Connect, i would ask on the VPN termination in the Meraki MX space.

Gary_Geihsler1 · ‎Aug 13 2024

Secure Client is included with Secure Connect. Secure Connect is our Unified SASE solution that facilitates secure access to the internet, secure access to private applications/resources (via VPNaaS, client-based ZTNA, and clientless ZTNA), and SD-WAN Interconnect. Currently Secure Connect does not support Always-on VPN. Always-On VPN is typically done via certificate authentication. Certificate authentication for VPN does not utilize TPM. The client-based ZTNA feels much like Always-on VPN but uses new technology that faster and more secure while providing an optimal user experience. The end user registers the first time using SAML and then a certificate is stored in TPM. The user does not have to login again in most cases.

Gary_Geihsler1 · ‎Aug 13 2024

Is your question in context of Secure Connect or considering terminating VPN on the MX itself?

Gary_Geihsler1 · ‎Aug 8 2024

I see, this challenge is one we have seen before. User education is the first answer-although one with multiple challenges of course. As was mentioned earlier, the new client ZTNA may alleviate some of this. The client ZTNA supports all ports and protocols and feels like an always-on VPN but is a different secure access method. The user experience is an initial enrollment process and then the user does not have to login when accessing private applications/resources. I created a short video showing the user experience. https://app.vidcast.io/share/50f01122-21c9-454e-ba90-7a347c8f3dd3

Gary_Geihsler1 · ‎Aug 7 2024

Jeff, the comment on having issues connecting to the VPN when onsite. Is the scenario the user tries to initiate the VPN while onsite and something is not working as expected? In most cases the VPN should not be needed while onsite. The ability to use groupings and/or objects in VPN exclusions is good feedback. I will submit to the MX team for consideration. As Philip mentioned the Secure Client Cloud Management can allow you to pre-package a single executable with the appropriate profiles (VPN, Umbrella Roaming Security) loaded. You can also manage upgrades from the Cloud Management. Not all options shown in cloud management work for Secure Connect. Always-on VPN si not supported in Secure Connect currently.

Gary_Geihsler1 · ‎Jul 1 2024

You do not have a valid entitlement for Secure Connect.

Gary_Geihsler1 · ‎Jun 25 2024

This forum is specific to Cisco Secure Connect, your question is not related to Secure Connect. I would post your question in the appropriate forum for best results.

Gary_Geihsler1 · ‎Jun 7 2024

The connections via AutoVPN will not show as active in the Umbrella>Network Tunnels page. Check the status of AutoVPN connections in the Meraki dashboard.

Gary_Geihsler1 · ‎May 9 2024

For clarity CloudHubs are different than Regions in the Secure Connect world. CloudHub is the legacy Cloud On-ramp capability. Regions are using the newer enhanced cloud native headend service (CNHE) with additional features and throughput. You need to remove your Cloud On-ramp deploy in order to deploy to the Australia-1 Region.

Gary_Geihsler1 · ‎Apr 17 2024

There is a better solution for you, Secure Connect. This is the evolution of Meraki and cloud security together. Secure Connect allows easier and more flexible ways to deploy MX sties to have the traffic inspected. Onboarding a spoke to Secure Connect does inject a default route to the spoke MX. We also can deploy MX hubs to Secure Connect which does not inject the default route. We can mimic the default route by using the Secure Connect Hubs as Exit hubs. There are flexible options how MX spokes communicate to MX hubs. Check out the Meraki Secure Connect documentation and the hub integrations here. In most cases we can move customers from Umbrella SIG to Secure Connect while retaining the same Umbrella org.

Gary_Geihsler1 · ‎Mar 8 2024

If meraki sites are connected to Secure Connect via AutoVPN they will automatically be advertising to Secure Connect reachable subnets. When you connect a non-meraki device via IPsec you will also define the routable subnets in the configuration. Once both tunnels are connected, you would need to enable a source-destination cloud firewall rule to allow connectivity as the default private app and network rule is a deny all. then the sites would be able to communicate with each other.

Gary_Geihsler1 · ‎Mar 7 2024

If the tunnel is terminating on a non-Meraki device you would use the Secure Connect>Network Tunnels section. As you are not creating a tunnel from a Meraki network to the third party you would not use the Meraki tunnel process. Documentation here.

Gary_Geihsler1 · ‎Feb 5 2024

ISE module by itself does not cause a conflict. If you have traffic set to split exclude and ISE is set to [Block untrusted server]; the split excluded traffic is blocked. Could you use the ISE module for purposes outside of Secure Connect, yes. Same with NAM- just have to be careful to deploy properly or there may be issues as you saw. If you are not using ISE or NAM, best to not include the modules.

Gary_Geihsler1 · ‎Feb 4 2024

The version of Secure Client (AnyConnect) that is available via the Universal Windows Platform has limitations when compared to the standard client software. Looking at the release notes here - there are multiple conflicts with Secure Connect. Most notably the lack of SAML 2.0 authentication which is the only supported authentication method in Secure Connect today. There are instructions for deploying the Umbrella Roaming Security Module alongside the Core VPN module here - additionally you want to deploy the Firewall Posture Module and DART (Diagnostics) module for full Secure Connect capability. I do not recommend deploying the NAM or ISE modules as they are not used and can cause issues if not configured properly.

Gary_Geihsler1 · ‎Jan 8 2024

This would depend on how the PoS/IoT device communicated. The clientless ZTNA supports web ports only. If a private resource communicated that way, then the answer is yes. If the private resource used other ports then then client based remote access would be needed.

Gary_Geihsler1 · ‎Jan 8 2024

Can you expand on the question please?

About Gary_Geihsler1

Gary_Geihsler1

Community Record

Badges