This page provides instructions for configuring client VPN services through the Dashboard.
For detailed instructions on how to configure a client VPN connection on various client device platforms, please refer to:
The client VPN service uses the L2TP tunneling protocol and can be deployed without any additional software on PCs, Macs, iOS devices, and Android devices, since all of these operating systems natively support L2TP VPN connections.
Note: Linux-based OSes can support client VPN connections as well, though third-party packages may be necessary to support L2TP/IP.
To enable Client VPN, choose Enabled from the Client VPN server pulldown menu on the Security Appliance > Configure > Client VPN page. You can configure the following Client VPN options:
Meraki Client VPN uses both pre-shared key based authentication and user authentication. To setup the user authentication mechanism, you will need to select your authentication method.
Use this option if you do not have an Active Directory or RADIUS server, or if you wish to manage your VPN users via the Meraki cloud. To add or remove users, use the User Management section at the bottom of the page. Add a user by clicking "Add new user" and entering the following information:
To edit an existing user, click on the user under the User Management section. To delete a user, click the X next to the user on the right side of the userlist.
When using Meraki hosted authentication, the user's email address is the username that is used for authentication.
Use this option to authenticate users on a RADIUS server. Click Add a RADIUS server to configure the server(s) to use. You will need to enter the IP address of the RADIUS server, the port to be used for RADIUS communication, and the shared secret for the RADIUS server.
Use this option if you want to authenticate your users with Active Directory domain credentials. You will need to provide the following information:
For example, considering the following scenario: You wish to authenticate users in the domain test.company.com using an Active Directory server with IP 172.16.1.10. Users normally log into the domain using the format 'test/username' and you have created a domain administrator account with the username 'vpnadmin' and the password 'vpnpassword'.
When using Meraki cloud authentication, Systems Manager Sentry VPN security can be configured If your Dashboard organization contains one or more MDM networks. Systems Manager Sentry VPN security allows for your devices enrolled in Systems Manager to receive the configuration to connect to the Client VPN through the Systems Manager profile on the device.
To enable Systems Manager Sentry VPN security, choose Enabled from the Client VPN server pulldown menu on the Security Appliance > Configure > Client VPN page. You can configure the following options:
When using Systems Manager Sentry VPN security, the username and password used to connect to the client VPN are generated by the Meraki cloud.
User names are generated based on a hash of a unique identifier on the device and the username of that device. Passwords are randomly generated.