meraki vpn client configuration with radius

#MERAKI VPN CLIENT CONFIGURATION WITH RADIUS DOWNLOAD#
#MERAKI VPN CLIENT CONFIGURATION WITH RADIUS WINDOWS#

In case of no RADIUS protocol traffic seen from the Meraki device, follow the steps below: If there is traffic seen, make sure to verify the username to make sure the traffic has been seen for the correct client device. With the Wireshark filter mentioned above, only the RADIUS traffic will be filtered in the output and if there is no RADIUS protocol traffic being sent out to the RADIUS server from the Meraki devices, the output will be empty. A sample packet capture can be downloaded for reference. The above screenshot is for a successful RADIUS authentication, as you can see bi-directional communication with Access-Requests, Access-Challenges and Access-Accept. The packet capture can be opened in Wireshark and a filter can be applied as shown below:Įg: ip.addr=192.168.128.254 & radius (192.168.128.254 is the IP of the RADIUS server)Ī generic filtered RADIUS packet capture is shown below for reference: Once a packet capture is initiated, have a failed client attempt to connect to RADIUS again and let the packet capture run while this process is being completed.

#MERAKI VPN CLIENT CONFIGURATION WITH RADIUS DOWNLOAD#

The packet capture must be taken on the wired interface of the Meraki device through which the RADIUS server can be reached, and it is highly recommended to download the output as a. This feature can be accessed by navigating to Network Wide > Monitor > Packet Capture. Thankfully it worked out well and now I have enabled 2FA on our corporate VPN.The Meraki Dashboard provides the ability to take packet captures directly on all RADIUS-capable Meraki devices in the network. Technically I could have done it at the office using mobile hotspots but doing it from the comfort of my house made more sense. I ended up testing my setup from home because I wouldn’t be able to connect to our Meraki VPN from inside the network. Following the Duo documentation makes this process relatively simple.

You will then add the server, containing your configured Duo Authentication Proxy, to your list of RADIUS servers on the Client VPN section of your Meraki Cloud console. If you ever modify your configuration file, you must stop and restart the DuoAuthProxy service as well as restart the Authentication Proxy.

Once you configure the INI file, the commands to start the proxy service actually check your configuration file for any errors as well as checks for connectivity to Duo. The rest of the configuration was step-by-step. I ended up using Active Directory/LDAP as our primary authenticator, utilizing a Read-Only Service Account to read the Active Directory service on my Domain Controller. Following the Duo documentation made things a little easier though. The configuration file is formatted as a simple INI file. Now this took me a little bit of time to configure. This is important because it gives the user plenty of time to receive and respond to the Duo Push notification. It was also the first Duo application I deployed, so I was slightly hesitant to do it on a Linux server.īut before installing and configuring the Duo Authentication Proxy, I needed to contact Meraki Support to have the Client VPN RADIUS Timeout value increased to 60 seconds. Therefore, I didn’t think that we should deploy the Duo Authentication Proxy on its own server. The proxy doesn’t utilize a significant amount of computing resources.

#MERAKI VPN CLIENT CONFIGURATION WITH RADIUS WINDOWS#

In my corporate situation, I have our Duo Authentication Proxy installed on a “miscellaneous” Windows server that runs a few different services. Regardless of the OS that you chose, Duo recommends a system with at least 1 CPU, 200 MB disk space, and 4 GB RAM (although 1 GB RAM is usually sufficient). Windows Server 2012 or later (Server 2016 or 2019 recommended).Duo authentication proxy receives the authentication responseįor this to work, the organization must configure the Duo Authentication Proxy on one of the following systems:.Secondary authentication via Duo Security’s service.Duo Authentication Proxy connection established to Duo Security over TCP port 443.Primary authentication using Active Directory or RADIUS.Meraki MX sends the authentication request to the Duo Authentication Proxy.Primary authentication initiated to Meraki Client VPN.This provides you that added layer of security. In a nutshell, it forces users to use a secondary form of authentication (Duo), via the Duo Authentication Proxy, when connecting to your Meraki Client VPN. SOLUTION: Duo integrates with your Meraki Client VPN to add two-factor authentication to any VPN login. This can be very problematic, from a security standpoint, because a compromised device could have direct access to your corporate environment using those saved credentials.

PROBLEM: The current Meraki Client VPN OS configuration allows users to save their login credentials to their devices. I did this project a while back and am now just writing this up.

Meraki vpn client configuration with radius