Client VPN OS Configuration

To configure an iOS device to connect to the client VPN, follow these steps:

• Navigate to Settings > General > VPN & Device Management > VPN > Add VPN Configuration
• Type:
  • L2TP: Set to L2TP
  • IKEv2: Set to IKEv2
• Description: This can be anything you want to name this connection, for example, "Work VPN"
• Server: Enter the hostname (for example: abc-abcd.dynamic-m.com) or the active WAN IP (for example: a.b.c.d)
  • Hostname is required for IKEv2 and preferred for L2TP to improve reliability during WAN failover
  • This information is located in the Meraki dashboard under Security & SD-WAN > Monitor > Appliance status
• Remote ID: (IKEv2 only) Enter the hostname (for example: abc-abcd.dynamic-m.com) 
• Local ID: (IKEv2 only) enter your VPN username 
• Account: Enter the username
• Password: Enter if desired
  • If the password is left blank, it will need to be entered each time the device attempts to connect to the client VPN
• Secret: (L2TP Only) Enter the shared secret that admin created in Security & SD-WAN > Configure > Client VPN
• Ensure that Send All Traffic is set to on
• Save the configuration

To configure a macOS device to connect to client VPN, see Set up a VPN connection on Mac in Apple Support.

The following VPN information is needed:

• Display Name: This can be anything you want to name this connection, for example, "Work VPN"
• Server: Enter the hostname (for example: abc-abcd.dynamic-m.com) or the active WAN IP (for example: a.b.c.d)
  • Hostname is required for IKEv2 and preferred for L2TP to improve reliability during WAN failover
  • This information is located in the Meraki dashboard under Security & SD-WAN > Monitor > Appliance status
• Remote ID: (IKEv2 only) Enter the hostname (for example: abc-abcd.dynamic-m.com) 
• Local ID: (IKEv2 only) enter your VPN username 
• Account Name: Enter the account name of the user (based on AD, RADIUS, or Meraki cloud authentication)
• Password: User password (based on AD, RADIUS or Meraki cloud authentication)
• Machine Authentication > Shared Secret: (L2TP only) Enter the shared secret that admin created in Security & SD-WAN > Configure > Client VPN 

The following authentication methods are supported:

• User authentication: Active Directory (AD), RADIUS*, or Meraki-hosted authentication
• Machine authentication: Pre-shared keys

When using Meraki-hosted authentication, the VPN account and username setting is the user email address entered in the Meraki dashboard.

To configure a Windows 10 or Windows 11 device to connect to client VPN, see Connect to a VPN in Windows in Microsoft Support page. Additional settings must be changed for Windows devices when trying to connect using IKEv2, as the default settings are not secure. Note that additional configuration changes are required for Windows devices connecting via IKEv2, as the default settings are not secure. Please see this article on the Microsoft support page for configuration details. 

Below is an example of supported security settings for configuring a Windows device using IKEv2:

• Encryption Algorithm: AES256
• Integrity (Hash) Algorithm: SHA256
• Diffie-Hellman Group (Key Size): DH14

The following VPN information is needed to complete the setup:

• In the Settings app  on your Windows device, select​​​​​​ Network & internet > VPN > Add VPN.
  • VPN provider: Set to Windows (built-in)
  • Connection name: This can be anything you want to name this connection, for example, "Work VPN"
  • Server name or address: Enter the hostname (for example: abc-abcd.dynamic-m.com) or the active WAN IP (for example: a.b.c.d)
    • Hostname is required for IKEv2 and preferred for L2TP to improve reliability during WAN failover
    • This information is located in the Meraki dashboard under Security & SD-WAN > Monitor > Appliance status
  • VPN type: 
    • LT2P: Select L2TP/IPsec with pre-shared key
    • IKEv2: Select IKE v2
  • User name and Password: optional

For L2TP: 

After the VPN connection has been created, set the Authentication protocols:

1. Choose the VPN connection and then select Advanced options > More VPN properties > Edit > Security Tab. 
   • Note: Alternatively, run ncpa.cpl directly from Search or Command prompt to quickly access your VPN adapters.
2. In the Security tab, under Data encryption > Select Require encryption (disconnect if sever declines)
3. Under Authentication > Select Allow these protocols > Tick the box Unencrypted password (PAP)
4. Verify that no other protocols are selected

 

Passwords sent over an IPsec tunnel between the client device and the MX are always encrypted, even when using PAP authentication protocols. The password is fully secure and never sent in clear text over the WAN or the LAN.