AnyConnect on Meraki!

 At long last, it is finally here. Meraki security appliances support AnyConnect in the open Beta release 16.4.

For those who are blissfully unaware, Meraki’s Client VPN was lacking. You had to use the Operating System’s built-in VPN client. I can’t speak for Linux or Mac, but for Windows clients this was an operation in patience. Win10 VPN often loses settings across Windows Updates and will sometimes just not work. It’s not super user friendly to set up. It sucks.

AnyConnect is used with Cisco’s ASA firewalls. A client establishes an SSL VPN tunnel between the PC and the firewall. It’s super easy to use and is fairly common for Enterprise users. From the administrative side, you can configure different policies for groups, realms, etc. I have had two AnyConnect gateways in my environment for a few years now. There’s a realm for Corp-owned devices, a realm for BYOD devices, and a realm for Vendors. We’re able to dictate access to these realms based on AD groups and leverage a 3^rd party MFA solution for hardened access. We have approximately total 125 users and – at our COVID peak – supported 80 users simultaneously. Our ASAs are approaching end of life so we have been shopping alternative edge firewall solutions. Meraki has been one of the competitors and having a decent remote access/client VPN solution is a must.

I was excited to get AnyConnect up and running on my homelab MX67. Once updated to the newest Beta firmware release, you get a handy option in your Dashboard under Security & SD-WAN, Client VPN. Turning it up is very easy:

1. Radio button from Disabled to Enabled
2. Choose how clients with Authenticate
3. Define a subnet for your AnyConnect VPN subnet

And that’s all that’s required. You’ll have to decide whether to use Google, Umbrella, or a custom DNS server; what traffic you’ll be tunneling; and how users will authenticate. Optionally, you can change the port AnyConnect uses, set a Log-in Banner, define a group policy, upload a CA for client certificate authentication. The page also provides the hostname used to connect to as well as links to download the AnyConnect client for Windows, Mac, or Linux. You must be on AnyConnect 4.9 or higher to connect to the MX.

            For my home deployment, DNS is pointed to my Pihole, we’re tunneling all traffic, and we’ll use Meraki Cloud Authentication for access. Additionally, we’ll designate my Dashboard Admin user as a VPN user. You can also set up a Meraki Cloud Guest users and define a password for just VPN access. All said and done, the completed config page looks something like this.

            Once done, you’ll want to get AnyConnect installed. For this example, I have it set up on my Windows laptop. 

             And now we’re connected! Simple! I also took the time to configure this on my iPhone AnyConnect app. The process is similarly straight forward.

            You'll notice a pretty short hostname in the two screenshots above. One quality of life fix I recommend is creating a CNAME entry with your DNS provider to simplify access. If you’re looking for a provider, I’ve used No IP in the past. Their free offering is fine, with a catch of requiring you to verify your DNS entries every 30 days. Their pay tiers are cheap, but I’m cheaper. 

            The big drawback to this is there’s no way to upload a custom SSL certificate. You’ll get a warning during the log in process, not showstopping but certainly undesirable, especially in any professional or enterprise environment. Hopefully this is addressed down the road.

            A major drawback is MX AnyConnect (MXConnect? AnyMX? these are free suggestions, Cisco) is an On-or-Off solution at this point. With no way to set up different subnets, lumping everyone in together limits your ability to get granular like you would on another NGFW (see my earlier comments on the ASA).

            I’m interested to see how Cisco continues to develop AnyConnect on Meraki. In its current form, it is no replacement for many of the existing Enterprise Client VPN solutions on the market. Right now, it’s a good fit for small/medium-sized businesses with basic remote access needs. It likely won’t push me to go full-stack Meraki but it’s certainly gives points in their favor.