Systems Manager VPN Configurations and Sentry VPN

Sentry VPN on Meraki MX-Z Devices

Sentry VPN Security allows you to define a tag-scope to receive a Dynamically generated VPN Configuration from the Security appliance > Configure > Client VPN page, and configured by selecting the appropriate tag scoping for your SM devices:

Sentry Configuration for VPN in Systems Manager

This option uses the Cisco Meraki cloud to automatically configure a VPN connection to a MX Security Appliance or VM Concentrator added in the same Dashboard Organization as the Systems Manager network.

1. Navigate to the Systems Manager > Manage > Settings page. 
2. Select the VPN tab.
3. Configuration: Select Sentry.
4. Security Appliance: Select the Dashboard network (MX or Concentrator) that contains the desired VPN connection. 
5. Auth type: If choosing Specify account, a prompt to specify the name of the user account for authenticating the connection will appear. If Use device identity is selected, Dashboard will automatically generate and use unique identifying credentials for each device when connecting to the MX VPN.  
6. Send All Traffic: Check this flag to send all device traffic through the VPN connection (Optional). 

The following screenshot displays an example of how to set up the Sentry VPN connection:

Manual Configuration

This option allows you to manually configure VPN settings.  The supported and configurable manual VPN protocols are L2TP, PPTP, IPsec (Cisco), and Cisco AnyConnect.  

1. Navigate to the Systems Manager > Manage > Settings page. 
2. Select the VPN tab. 
3. Configuration: Choose Manual.
4. Connection Name: Input a name for the VPN connection that will be displayed on the iOS device. 
5. Connection Type: Select either L2TP, PPTP, or IPsec (Cisco). 
6. Sever: Input the public IP address of the VPN server. 
7. Shared Secret (L2TP Only): Input the shared secret for the VPN connection.
8. User Authentication: Select the user authentication method. Choosing Password allows the device user to be prompted for a password when using the VPN connection. 
9. Account: Specify the name of the user account used for authenticating the connection (e.g., DOMAIN\username, or username@domain.tld). 
10. Group Name (AnyConnect Only): Specifies the group in which the AnyConnect Account resides).  
11. Send All Traffic: Check this flag to send all device traffic through the VPN connection (Optional). 
12. Proxy Setup: Configure a proxy to be used with the connection (Optional).  

The following screenshot displays an example of how to setup the Manual VPN connection. Settings vary depending on the VPN connection type.

Systems Manager can be used to push VPN configuration settings to remotely managed iOS, macOS, Windows 10, and Samsung KNOX enabled Android devices.  Adding a MX or Concentrator network to the Dashboard Organization can greatly simplify the configuration process by importing the VPN settings, and automatically updating them if any changes are made. Once the managed devices are able to check-in with SM, the VPN connection profile payload will install and be available for the device user to select.