- Configuring non-Meraki peer VPN settings and allowing this connection based on tag. To tag a Meraki network, simply navigate to Organization Overview in the Meraki dashboard and select one or more networks to tag. Then click the “Tag” button at the top left corner of the network listing table, and add, remove, or create a new tag.
- Forbes concluded that 18% of VPNs had potential malware or viruses. Trust Meraki to keep your data and applications secure. Plan for the future Partner with us to establish the future of your workforce.
Cisco Meraki uses the integrated Windows client for VPN connection (no Cisco client at this time).
To be able to connect with simple AD user account credentials, along with a simple pre-shared key, the steps are very simple.
The Meraki Client VPN RADIUS instructions support push, phone call, or passcode authentication for desktop and mobile client connections that use SSL encryption. This configuration does not feature the interactive Duo Prompt for web-based logins. On the MX appliance, go to Event Log and select 'VPN Client Connected' and 'VPN Client Disconnected' from the 'Event Types Include' field and search with the desired time frame. You could also set up an alert to email you when a VPN connection comes up or goes down. If you have a lot of VPN users, those emails might just be an annoyance.
9 Steps total
Step 1: Get started
Click on Start and type in VPN, click on Change Virtual Private Networks (VPN)
Step 2: Add connection
Click on Add a VPN connection
Step 3: Configure Windows connection
Pick VPN provider as Windows
Name the connection
Put in server name or IP
Switch VPN type to L2TP/IPsec with pre-shared key
Switch Type of sign in to User name and password
Enter the username and password if you want to save it, or leave blank and user will have to enter it on connection
Hit Save
Step 4: Edit settings
Once you hit Save, it will bring you back to the connection page
Click on Change Adapter Options
Step 5: Configure adapter
In the adapter window, click on the adapter with the name you created in the VPN window
Click on Change settings of this connection
Step 6: Step 6
Click on Security tab
Make sure Type of VPN is still Layer 2 Tunneling Protocol with IPsec
Set Data encryption to Require encryption (disconnect if server declines)
Set Allow these protocols
Check Unencrypted password (PAP) - will still be, so don't worry
Click Advanced settings
Step 7: Add key
In the Advanced settings, click on Use preshared key
Type in the key you want to use
Hit OK to go back to the adapter settings
Click OK to close the adapter settings and save.
Close all other windows at this point.
Step 8: Connect
Connect ...
Click on the network icon in the system tray
Click on the VPN network connection name
Click on Connect
Step 9: Verify and disconnect
Verify you are connected
Click on the network system tray icon again if the window closed or minimized
You should now see the VPN network name listed and Connected underneath it
(If you are done with your connection, click on it and click Disconnect)
Now and then Windows Updates breaks the encryption settings by changing from PAP to MS-CHAP. If users could connect before, but suddenly can't while others can, revisit Step# 6 and verify PAP is turned on, not MS-CHAP. Save and all set!
Meraki Vpn Error 789
8 Comments
- ChipotleBMG_Zone Jun 20, 2018 at 12:42pm
I have a customer who is stating:
We've run into a weird problem where the built in Windows 10 vpn gets its settings changed whenever the wifi network changes. We have consultants who travel to various client sites and every time they try to connect to our vpn server they have to fix their vpn settings. The company we had hired to set up our vpn server said they can't help us with this, probably because it's a Windows issue
Any Ideas?
- HabaneroKrasimirPetrov_ Oct 31, 2018 at 02:46am
Good read. Thank you very much for sharing.
Excellent tutorial - SonoraLRSpartan Jan 8, 2019 at 04:49pm
We have been trying to overcome the same problems with MX64 and making an outbound rule entry in Windows Defender Firewall is what helped us. We had performed all the other instructions Meraki and MSFT had provided including the regedit (asumeUDPEncap...).
We created a UDP port rule for 500, 4500 and scoped it to our vpn IP address. Finally works.
I hope this helps.
- Pimientoericguth2 Jan 28, 2020 at 09:00am
LRSpartan - are you saying that you port forward UDP 500 and 4500 to your VPN range 192.168.XXX.00/24?
- PoblanoAaronTheYoung Feb 3, 2020 at 08:15pm
We are constantly plagued by our VPN connection losing its settings as well. I'm not sure if this it relates to change in WiFi, but the people that it occurs with do seem to be people that change WiFi often. Others who are using it from one network at home seem to not have the issue.
In any case, I am constantly connecting to users who are remote and fixing their settings. Either resetting their Username and Password settings or fixing the PAP/CHAP protocol settings.
Is there a way to use the Powershell command ADDVPNConnection to create a script that would re-create the settings in one fell swoop?
Any help would be appreciated.
- Datiltroberts2 Mar 4, 2020 at 08:22pm
We have seen those same settings and we hear there may be a Meraki VPN Client or Cisco AnyConnect Client that is Meraki compatible in the near future, but that has also been ongoing for like 3 to 4yrs now. Once it comes out, should be a moot point on Microsponge changing your settings. I have seen the same issue though, seems to be mostly tied to Microsoft and the firewall flipping the network to public and effectively blocks like everything so you can't connect. Only way we have gotten it to work is when on that network, switch it from Public to Private, reboot the machine and possibly also the network router you are using and then it works, and yes you are sharing when connected initially to that network, but once on the VPN, tunneled into your network and secure again. Fingers X'd on the client coming out vs WinDoze client.
- Pimientospicehead-hu3x0 Apr 14, 2020 at 06:09pm
The Dreytek VPN client works for the meraki, I hope Cisco comes out with their own soon.
- Jalapenobranchms Jan 21, 2021 at 10:04pm
I'm having nothing but trouble getting this to connect.
Using windows 10 and Meraki MX64.Can you suggest a resolution?
Security Audit Failed due to Aggressive Mode IKE (MX 14 firmware and earlier)
Meraki Vpn Connections
Prior to the release of the MX 15 firmware branch, Cisco Meraki MX Client VPN required the use of Aggressive Mode IKE in order to use Pre-Shared Key authentication and avoid the installation of certificates on clients. Customers who have Client VPN enabled on older firmware releases may fail PCI, SOX, or other security audits because Aggressive Mode IKE is detected. In some cases, this can be appealed provided the PSK is complex enough. If that's the case, something similar to the line below should appear in the remediation notes for the report:
'If you are unable to disable Aggressive Mode IKE, then you should ensure that the pre-shared keys are strong. Like any password, be sure to use complex PSK values, and rotate the keys as often as is practical. These are recommended to be an alphanumeric value greater than 16 characters. If you already have a strong password policy for the PSKs, then you can appeal this vulnerability.'
In the event that the auditing entity being used does not allow appeals of this vulnerability, customers should plan to upgrade to MX15 firmware. If this is not immediately possible, then client VPN may need to be disabled to address this concern.
Meraki Vpn On Mac
Note: If client VPN is enabled, people commonly fail their PCI compliance tests due to CVE-2002-1623.