Meraki

SahandC · ‎Oct 27 2024

Hi Dazza_wifi, Good things come to those who ask 😉. Ask your Meraki sales rep for a Meraki MX & Secure Connect trial to see the full benefits of the solution - https://meraki.cisco.com/en-uk/form/contact/ When you get your hands on it, here's an implementation series I've been working on: https://www.youtube.com/playlist?list=PLOaVYwC_uLF6C_Rx5lEQzPFdWIwr-7AGV

from_afar · ‎Sep 26 2024

Not sure how/why, but the next day it started working fine. The blank page goes away and I get the familiar "You are connected" message and the VPN works. No idea what caused or fixed the issue...

Gary_Geihsler1 · ‎Sep 4 2024

Multi-factor Authentication is not included in Secure Connect licensing, we have an open system that can support multiple SAML 2.0 MFA providers. If you would like MFA (highly recommended) you would purchase your MFA solution separately. Secure Client is the new major version of AnyConnect. At AnyConnect version 5.0 (now rebranded as Secure Client) there was a major change that allowed Cisco Endpoint Security Agent to be installed as a single software client with Secure Client (on Windows only). Additional modules have been added to Secure Client such as ThousandEyes and ZTNA. The end goal is to have a single software client and child modules that fit specific use cases. Licenses for Secure Connect are calculated on a per named user basis. We have a user defined also as 20GB of data processed per user per month in aggregate. There are some non-standard scenarios where per-user calculations are challenging (retail, industrial) and we have guidance posted for Cisco internal and partners how to quote for those scenarios.

Gary_Geihsler1 · ‎Aug 21 2024

Currently the client-based ZTNA will always intercept traffic for destinations identified as client-based ZTNA traffic. There is no concept of Trusted Network in client-ZTNA yet.

Martin_Briand · ‎Aug 21 2024

Hi RobustMeraki, For this you can go SAML and integrate Duo with Passwordless (if you have the needed requirements for Windows Hello, from hardware and licensing perspectives). Or can you use a phone one button validation (coupled with risk based authentication, to ask for a code only in risky situations). Or you could use DUO with a FIDO2 or U2F device such as yubikey, to validate any auth by simply touching it.

Andrewww1 · ‎Aug 16 2024

Hi @Gary_Geihsler1 , seen on both even if I am using Traffic steering for the IPs seen in the pcap during a WhatsApp call

Gary_Geihsler1 · ‎Aug 8 2024

I see, this challenge is one we have seen before. User education is the first answer-although one with multiple challenges of course. As was mentioned earlier, the new client ZTNA may alleviate some of this. The client ZTNA supports all ports and protocols and feels like an always-on VPN but is a different secure access method. The user experience is an initial enrollment process and then the user does not have to login when accessing private applications/resources. I created a short video showing the user experience. https://app.vidcast.io/share/50f01122-21c9-454e-ba90-7a347c8f3dd3

Sankar_V · ‎Jul 1 2024

Thanks, Gary! Then it must be the same as what @PhilipDAth said.

Gary_Geihsler1 · ‎Jun 25 2024

This forum is specific to Cisco Secure Connect, your question is not related to Secure Connect. I would post your question in the appropriate forum for best results.

Gary_Geihsler1 · ‎Jun 7 2024

The connections via AutoVPN will not show as active in the Umbrella>Network Tunnels page. Check the status of AutoVPN connections in the Meraki dashboard.

Gary_Geihsler1 · ‎Apr 17 2024

There is a better solution for you, Secure Connect. This is the evolution of Meraki and cloud security together. Secure Connect allows easier and more flexible ways to deploy MX sties to have the traffic inspected. Onboarding a spoke to Secure Connect does inject a default route to the spoke MX. We also can deploy MX hubs to Secure Connect which does not inject the default route. We can mimic the default route by using the Secure Connect Hubs as Exit hubs. There are flexible options how MX spokes communicate to MX hubs. Check out the Meraki Secure Connect documentation and the hub integrations here. In most cases we can move customers from Umbrella SIG to Secure Connect while retaining the same Umbrella org.

PhilipDAth · ‎Mar 10 2024

Good information @Gary_Geihsler1 . I must get a licence for this so I can play with it.

Gary_Geihsler1 · ‎Feb 5 2024

ISE module by itself does not cause a conflict. If you have traffic set to split exclude and ISE is set to [Block untrusted server]; the split excluded traffic is blocked. Could you use the ISE module for purposes outside of Secure Connect, yes. Same with NAM- just have to be careful to deploy properly or there may be issues as you saw. If you are not using ISE or NAM, best to not include the modules.

Gary_Geihsler1 · ‎Jan 8 2024

This would depend on how the PoS/IoT device communicated. The clientless ZTNA supports web ports only. If a private resource communicated that way, then the answer is yes. If the private resource used other ports then then client based remote access would be needed.

Gary_Geihsler1 · ‎Jan 8 2024

Can you expand on the question please?

brianpmcp · ‎Dec 12 2023

Hi Gary, Could the VMX in passthrough mode still use BGP to propogate Azure routes?

Gary_Geihsler1 · ‎Nov 2 2023

I would contact support to diagnose the issue. There is the chance that when you tried to connect to a specific DC it was down for maintenance, periodically updates are done that might take a DC out for a short period of time. This is the reason the auto select is there to connects users to the best DC at that point in time.

SardarAlam · ‎Oct 30 2023

This is already configured and work for now we need to access our domain from external network not internal.

alemabrahao · ‎Oct 3 2023

Probably yes, as the documentation does not mention license lever. https://documentation.meraki.com/CiscoPlusSecureConnect

Gary_Geihsler1 · ‎Sep 13 2023

Sorry if I was not clear. What pieces are your trying to connect together is what I am trying to understand. Your original post mentions AnyConnect (client VPN), Azure, CSR (Cloud Services Router), and MX100. Where are you trying to terminate a VPN session and how do you want to authenticate?

Gary_Geihsler1 · ‎Aug 18 2023

New video on how easy it is to bring in new employees with Cisco+ Secure Connect. https://app.vidcast.io/share/068ff2f6-62ab-4674-96c5-653d2ebb4d93

Gary_Geihsler1 · ‎Jul 17 2023

There are two different questions here. 1. Secure Connect DC IP addresses- We utilize the Umbrella DCs so we use the same public IP addresses as Umbrella when connecting via IPsec tunnels. You can see the Umbrella DCs and their IP addresses here. Note no all Umbrella DCs support Secure Connect, check the Secure Connect DC list here. 2. The public IP that will be listed as the source when landing at a destination such as a SaaS application will be one of the IPs in the Umbrella ranges. 146.112.0.0/16, 155.190.0.0/16, 151.186.0.0/16. We are just launching Reserved IP as a function in Secure Connect which will allow a customer to purchase dedicated IP addresses, more details to come on the Reserved IP capabilities.

jbright · ‎Jun 16 2023

FYI, Cisco Secure Client 5.0.03072 is available for download from the Cisco web site if you have a valid software license for it.

Gary_Geihsler1 · ‎Jun 16 2023

Currently neither MX nor Secure Connect headends have an auto-update capability. You can get some monitoring capabilities with a MDM/EMM platform or SecureX Device Insights. Some MDM/EMM platforms have enforcement capabilities.

GreenMan · ‎Jun 14 2023

I'd go for this instead: https://documentation.meraki.com/MX/Deployment_Guides/vMX_and_Azure_Route_Server A lot will depend on how important the service is to you - a single IPsec tunnel to a single IPSec terminator is pretty simple on a drawing - less easy to set up as it's cross-vendor. And if any point of it fails, you might be wishing you'd invested a bit more time in a resilient solution up-front...?

About Gary_Geihsler1

Gary_Geihsler1

Community Record

Badges