Step 1 Install Cisco anyconnect VPN client for Mac OS X. Double click on AnyConnect. If you see the message: “This package will run a program to determine if the software can be installed”.

This page provides instructions for configuring client VPN services through the Dashboard.

For detailed instructions on how to configure a client VPN connection on various client device platforms, please refer to:

Client VPN

The client VPN service uses the L2TP tunneling protocol and can be deployed without any additional software on PCs, Macs, iOS devices, and Android devices, since all of these operating systems natively support L2TP VPN connections.

Note: Linux-based OSes can support client VPN connections as well, though third-party packages may be necessary to support L2TP/IP.

Note: Establishing a client VPN connection when the client is located on the LAN of the MX is unsupported.

Encryption Method

Client VPN uses the L2TP/IP protocol, with the following encryption and hashing algorithms: 3DES and SHA1 for Phase1, AES128/3DES and SHA1 for Phase2. As a best practice, the shared secret should not contain any special characters at the beginning or end.

Owing to changes in the PCI-DSS Standard version 3.2, some auditors are now enforcing requirements for stronger encryption than the Meraki Client VPN default settings provide. Please contact Meraki Support if you need these values adjusted, but please be aware that some client devices may not support these more stringent requirements (AES128 encryption with DH group 5).

Client VPN Server Settings

To enable Client VPN, choose Enabled from the Client VPN server pulldown menu on the Security Appliance > Configure > Client VPN page. You can configure the following Client VPN options:

• Client VPN subnet: The subnet that will be used for Client VPN connections. This should be a private subnet that is not in use anywhere else in your network. The MX will be the default gateway on this subnet and will route traffic to and from this subnet.
• DNS Nameservers: The servers VPN Clients will use to resolve DNS hostnames. You can choose from Google Public DNS, OpenDNS, or specifying custom DNS servers by IP address.
• WINS: If you want your VPN clients to use WINS to resolve NetBIOS names, select Specify WINS Servers from the drop-down and enter the IP addresses of the desired WINS servers.
• Secret: The shared secret that will be used to establish the Client VPN connection.
• Authentication: How VPN Clients will be authenticated (see below).
• Systems Manager Sentry VPN security: Configuration settings for whether devices enrolled in systems manager should receive a configuration to connect to the Client VPN (see below):

Authentication

Meraki Client VPN uses both pre-shared key based authentication and user authentication. To set up the user authentication mechanism, you will need to select your authentication method.

Meraki cloud authentication

Use this option if you do not have an Active Directory or RADIUS server, or if you wish to manage your VPN users via the Meraki cloud. To add or remove users, use the User Management section at the bottom of the page. Add a user by clicking 'Add new user' and entering the following information:

• Name: Enter the user's name.
• Email: Enter the user's email address.
• Password: Enter a password for the user or click 'Generate' to automatically generate a password.
• Authorized: Select whether this user is authorized to use the Client VPN.

To edit an existing user, click on the user under the User Management section. To delete a user, click the X next to the user on the right side of the user list.

When using Meraki hosted authentication, the user's email address is the username that is used for authentication.

RADIUS

Use this option to authenticate users on a RADIUS server. Click Add a RADIUS server to configure the server(s) to use. You will need to enter the IP address of the RADIUS server, the port to be used for RADIUS communication, and the shared secret for the RADIUS server.

Active Directory

Use this option if you want to authenticate your users with Active Directory domain credentials. You will need to provide the following information:

Cisco Vpn Client Mac Download

• Short domain: The short name of your Active Directory domain.
• Server IP: The IP address of an Active Directory server on the MX LAN.
• Domain admin: The domain administrator account the MX should use to query the server.
• Password: Password for the domain administrator account.

For example, considering the following scenario: You wish to authenticate users in the domain test.company.com using an Active Directory server with IP 172.16.1.10. Users normally log into the domain using the format 'test/username' and you have created a domain administrator account with the username 'vpnadmin' and the password 'vpnpassword'.

• Your Short domain would be 'test'.
• Your Server IP would be 172.16.1.10.
• Your Domain admin would be 'vpnadmin'.
• Your Password would be 'vpnpassword'.

Note: At this time, the MX does not support mapping group policies via Active Directory for users connecting through the Client VPN.

Download Cisco Anyconnect Client Mac

Systems Manager Sentry VPN security

When using Meraki cloud authentication, Systems Manager Sentry VPN security can be configured If your Dashboard organization contains one or more MDM networks. Systems Manager Sentry VPN security allows for your devices enrolled in Systems Manager to receive the configuration to connect to the Client VPN through the Systems Manager profile on the device.

To enable Systems Manager Sentry VPN security, choose Enabled from the Client VPN server pulldown menu on the Security Appliance > Configure > Client VPN page. You can configure the following options:

• Install Scope: The install scope allows you to select a set of Systems Manager tags for a particular MDM network. Devices with these tags applied in a Systems Manager network will receive a configuration to connect to this network's Client VPN server through their Systems Manager profile.
• Send All Traffic: Select whether all client traffic should be sent to the MX.
• Proxy: Whether a proxy should be used for this VPN connection. This can be set to automatic, manual, or disabled

When using Systems Manager Sentry VPN security, the username and password used to connect to the client VPN are generated by the Meraki cloud.

Usernames are generated based on a hash of a unique identifier on the device and the username of that device. Passwords are randomly generated.

Is the Cisco AnyConnect VPN compatible with Mac OS X El Capitan (10.11)?