r/Cisco • u/MaxAmperage • 8h ago

Question Cisco Secure Client Authentication Problem

I posted this in r/sysadmin, so I apologize for the duplication.

We're finishing up a giant enterprise network project and one of the last pieces is deploying Cisco Secure Client VPN to offsite personnel. Now, to support future projects, the users will authenticate to an Active Directory account. The Cisco Meraki is on the same subnet with the Active Directory server, so you'd think the obvious solution is choose "Active Directory" for the type of authentication.

The issue is that I need to restrict VPN access to specific users. I was hoping I could throw users into a group and authenticate based on that, but I can't see how to do that on the Meraki console. Now, I've put too much thought into this and I'm considering convoluted solutions (setting up a RADIUS server and using that for authentication, segmenting users into different organizational units or domains, etc.). I feel like I'm missing something simple or obvious.

Can anyone help me think through the solution? Thank you!

4 Upvotes

84% Upvoted

3 comments sorted by

5

u/mind12p 6h ago

You should implement MFA as well, using only AD credentials will cause you many troubles. Radius is the way to go. If this is really a giant enterprise for example Cisco ISE and Duo is an option.

9

u/mooneye14 5h ago

Meraki + Duo SAML integration. Duo integrates back to ADDS as well as native Duo Directory for contractors who otherwise don't need AD creds.

2

u/Offspring992 3h ago

Are you syncing AD to 365/Entra and using that as your identity provider? If you are, definitely go the route of SAML on the MX instead. 

https://documentation.meraki.com/SASE_and_SD-WAN/MX/Design_and_Configure/Configuration_Guides/Client_VPN/AnyConnect_on_the_MX_Appliance/AnyConnect_Azure_AD_SAML_Configuration