Stanford's VPN allows you to connect to Stanford's network as if you were on campus. Download the VPN installer from MIT's download page, Cisco AnyConnect VPN Client for Windows. Note: MIT certificates required. Find and double click the downloaded file named 'anyconnect-win-4.5.XXXXXX.exe', where XXXXXX is the sub-version number of the installer.

• Cisco Anyconnect Vpn Setup Download
• Anyconnect Vpn Configuration Cli

Overview

The Cisco AnyConnect Secure Mobility Client consistently raises the bar by making the remote-access experience easy for end users. It helps enable a highly secure connectivity experience across a broad set of PC and mobile devices. This document provides information on the AnyConnect integration on Meraki appliances and instructions for configuring AnyConnect on the Meraki dashboard.
Client Download and Deployment
AnyConnect Authentication Methods
AnyConnect Troubleshooting Guide
AnyConnect on ASA vs. MX
FAQ

Feature

The AnyConnect VPN server on the MX uses TLS & DTLS for tunneling and requires AnyConnect VPN client version 4.8 or higher on either Windows, macOS, Linux, or mobile devices to terminate remote access connections successfully. The AnyConnect client negotiates a tunnel with the AnyConnect server and gives you the ability to access resources or networks on or connected to the AnyConnect server (MX). Unlike the AnyConnect implementation on the ASA, with support for other features like host scan, web launch, etc, the MX security appliance supports SSL, VPN, and other AnyConnect modules that do not require additional configuration on the MX. For more details, see AnyConnect on ASA vs. MX.

An AnyConnect Plus/Apex (termed or perpetual) license will be required to use AnyConnect on the MX when MX16.X firmware goes GA. Until then, if an MX upgrades to MX16, AnyConnect will be available as a feature. If a license is not linked when MX16 goes GA, AnyConnect will become unusable until a license is applied. More details on applying licenses will be available soon.

The MX supports L2TP/IPsec Client VPN and AnyConnect VPN simultaneously.

Caveats

AnyConnect is still in development, hence, there are certain caveats to keep in mind before enabling AnyConnect.

• Supported MX models: MX600, 450, 400, 250, 100, 84, 68, 67, Z3, vMX

  Future support: MX64, 65

  Not supported: MX80, 90, 60, Z1

• IPsec and AnyConnect share the same configured RADIUS and active directory servers

• The use of a server identity certificate with a custom hostname is not supported at this time. Currently, the MX will automatically enroll in a publicly trusted certificate using the Meraki Dynamic DNS host name on the dashboard network. Follow the instructions on this doc to change the hostname.
• A BETA firmware version is required. Known issues are listed below:
  • Multicast on the LAN does not work as expected
  • BGP routes do not show up on the dashboard route table but are present on the device
    

How to Enable AnyConnect on Your Dashboard

Having reviewed the caveats, upgrade your MX security appliance to the required firmware version.

• To enable AnyConnect, upgrade to the latest MX-16 firmware by navigating to Dashboard > Organization > Firmware upgrades. For more details on firmware upgrades see Managing Firmware Upgrades
• For further inquiries, email meraki-anyconnect-beta@cisco.com

AnyConnect Server Settings

MX Server certificate: The AnyConnect server on the MX uses TLS for tunnel negotiation, hence it needs a server identity certificate. Currently, when AnyConnect is enabled, the MX will automatically initiate a certificate-signing request to get a publicly trusted identity certificate; this is entirely transparent to the dashboard administrator. The MX uses the Meraki Dynamic DNS hostname when creating a CSR before getting it signed by a public CA. The resulting certificate renews automatically without any disruption in service.

Dashboard administrators do not have to worry about creating or transporting certificates or private keys to the MX or interacting with public CAs to get a CSR signed. At this time, we do not support uploading a server certificate or using a hostname other than the Dynamic DNS name.

Uploading a server identity certificate or using a hostname other than the Dynamic DNS name is not supported at this time. Please use the 'How to create a profile' documentation to create an alias for the Meraki DDNS hostname to ease connectivity for end-users.

DDNS hostname is configurable on MX Appliances in Passthrough/VPN Concentrator mode when AnyConnect is enabled.

To enable AnyConnect VPN, select Enabled from the AnyConnect Client VPN radio button on the Security Appliance > Configure > Client VPN > AnyConnect Settings tab. The following AnyConnect VPN options can be configured:

Hostname: This is used by Client VPN users to connect to the MX. This hostname is a DDNS host record that resolves to the Public IP address of the MX. The DDNS hostname is a prerequisite for the publicly trusted certificate enrollment. You can change this hostname by following the instructions here.
AnyConnect port: This specifies the port the AnyConnect server will accept and negotiate tunnels on.
Log-in banner: This specifies the message seen on the AnyConnect client when a user successfully authenticates. If configured, a connecting user must acknowledge the message before getting network access on the VPN.

Profile update: This specifies the AnyConnect VPN configuration profile that gets pushed to the user on authentication.

Certificate authentication: This is used to configure the trusted CA file that is used to authenticate client devices. This configuration is only required if you need to authenticate client devices with a certificate.
Authentication Type: This is used to specify authentication with Meraki Cloud, RADIUS, or Active Directory.

Group policy with RADIUS Filter-ID: This is used to enable dashboard group policy application using the filter passed by the RADIUS server.

RADIUS time-out: This is used to modify the RADIUS time-out for two-factor authentication and authentication server failover.
AnyConnect VPN subnet: This specifies the address pool used for authenticated clients.
DNS name servers: This specifies the DNS settings assigned to the client.
DNS suffix: This specifies the default domain name or DNS suffix passed to the AnyConnect client to append to DNS queries that omit the domain field. This domain name only applies to tunneled packets.

Client routing: This is used to specify full or split-tunnel rules pushed to the AnyConnect client device. You can send all traffic through VPN, all traffic except traffic going to specific destinations, or only send traffic going to specific destinations.
Default group policy: This is used to apply a default group policy to all connecting AnyConnect clients. For more details see Group Policies.

Authentication Methods

AnyConnect supports authentication with either RADIUS, Active Directory, or Meraki Cloud. For more details on authentication configuration, refer to AnyConnect Authentication Methods.

Note: Systems Manager with Sentry is not supported with AnyConnect.
Note: SAML authentication is not supported at this time.

Client Routing

i. Send all traffic through VPN
This is the same as full tunneling. All traffic from the client is sent over the VPN tunnel.
ii. Send all traffic except traffic going to these destinations
This is the same as full tunnel with exclusions, when configured, the client will send all traffic over the VPN except traffic destined for the configured subnet.

iii. Only send traffic going to these destinations
This is the same as spilt tunneling, when configured, the client will only send traffic destined for the configured subnet over the VPN. Every other traffic sent over the local network.

Local LAN access

Local LAN access is desired when the Full tunneling is configured (Send all traffic through VPN) but users still desire to their local network for printing, etc For example, a client that is allowed local LAN access while connected to the MX in full tunnel mode is able to print to a local printer at home. Internet traffic will still flow through the tunnel.
To enable local LAN access, two things need to be done. Local LAN access will not work if both conditions are not satisfied.

1. Configure the MX: Select 'Send all traffic except traffic going to these destinations' option on the Dashboard and configure a 0.0.0.0/32 route. This will cause the AnyConnect client to automatically exclude traffic destined for the user's local network from going over the tunnel.

2. Configure the Client: Enable Allow local LAN Access on the AnyConnect Client. This can be enabled manually or via the AnyConnect profile.

After connection, the user should see their local network subnet added as a non secure routes (destinations that should be accessed locally not via the VPN tunnel)

Group Policies

The need for access control over remote access connections cannot be over-emphasized. While some administrators use multiple address pools to segment users, others use VLAN tagging to existing subnets. From a Client VPN standpoint, multiple subnets or separate VLANs do not provide access control in itself. What segments users from talking to each other or other network resources is the presence and the enforcement of access rules. For example, if users are in different VLANs and access policies are not enforced somewhere, users could access anything.
AnyConnect on the MX does not support multiple VLANs or address pools for Client VPN users. However, the MX supports the application and enforcement of policies to AnyConnect users on authentication. It is also important to note that, from a Client VPN standpoint on the MX, having users on the same subnet does not mean they are in the same VLAN. Users are assigned a /32 address (one address) from the pool configured on Dashboard. Group Policies can then be used to limit users on the same AnyConnect subnet from talking to each other or other resources on the network.

Default Group Policy

Administrators can apply a global group policy to all users connecting through AnyConnect by selecting a configured policy from the default Group Policy drop-down menu. Group policies can be configured via Dashboard > Network-wide > Group Policies. Refer to Creating and Applying Group Policies for more details.
Note: If a default group policy set and group policy with Filter-ID is also enabled, the Filter-ID policy passed by the RADIUS server will take precedence over the default group policy.

Group Policies with RADIUS Filter-ID

AnyConnect supports the application of dashboard-configured group policies to AnyConnect users when authenticating with RADIUS. This is achieved using the RADIUS Filter-ID attribute. To set this up on your MX:

1. Create group policies on Dashboard > Network-wide > Group Policies. Specify rules within the policy. Multiple group policies can be mapped to different user groups on the RADIUS server. In this example, we are matching CONTRACTOR policy to CONTRACTOR user group.
   

2. Enable the Filter-ID option on the dashboard. This option is only configurable if you are authenticating with a RADIUS server.
   

3. Configure the RADIUS server to send an attribute in its accept message containing the name of a group policy configured in dashboard (as a String). Commonly, the Filter-ID attribute will be used for this purpose. The screenshot below shows a network policy in Windows NPS, configured to pass the name of a dashboard group policy ('CONTRACTOR') within the Filter-ID attribute:

The RADIUS server is configured with the group policy 'CONTRACTOR' defined on dashboard. When a user in the group successfully authenticates, the 'CONTRACTOR' group policy name for the authenticated user will be sent in the RADIUS accept message, allowing the MX to apply the requested policy to the user. The group policy name sent by the RADIUS server must match verbatim what is configured on the dashboard for policies to apply correctly. Currently, policies do not show up on Network-wide > Client list page if you have only a security appliance in your dashboard network, however, If you have a combined network, the policy will show under the 802.1X policy column.

Client VPN Connections

Client view:
You can see client stats and connection details by clicking on the graph in the bottom-left corner of the client.

Clients can also see available routes on the Route Details tab. Secure routes are accessible by the client over the VPN while nonsecure routes are not accessible by the client over the VPN. Nonsecure routes are visible when split-tunneling is configured.

Connection logs can be found under the Message History tab.

Dashboard view: Iphemeris astrology.
After configuring client VPN, to see how many users are connected to your network, navigate to Network-wide > Clients. All AnyConnect clients will be seen with the AnyConnect icon. You can filter by client VPN using the search menu.

Cisco Anyconnect Vpn Setup Download

Note: The MAC address seen on the client list is randomly generated; it is not the actual MAC address of the AnyConnect client.

AnyConnect Event Logging

To see all available events, navigate to Network-wide > Event log and filter the 'Event type include' field by AnyConnect.

To see log-on and log-off events, go to Dashboard > Network-Wide > Event logs and filter by VPN client connected and VPN client disconnected.

Dashboard API Support

APIs can be used to configure or return the AnyConnect server settings on the MX. Navigate to Dashboard > Help > API docs - AnyConnect VPN Settings for more information.

Number of Supported Sessions per MX Model

Below is the number of sessions allowed per MX model. When the limit is reached, new sessions will not be formed.

FAQ

1. Who signs the Meraki facilitated publicly trusted certificates?
   A publicly trusted Certificate Authority.

2. Can I use my own hostname or publicly trusted certificate on the MX as a server certificate?
   No, only the Meraki DDNS hostname of the dashboard network is supported with publicly trusted certificates. There will be support for custom hostname certificates in future.

3. How will AnyConnect be licensed on the Meraki MX?
   Eventually, an AnyConnect Plus/Apex termed or perpetual license from Cisco will be required to use AnyConnect on the MX. Right now, AnyConnect can be used on the MX without a license.

4. Will every MX model support AnyConnect eventually? If yes, when? If No, why?
   AnyConnect is part of the wired-16 firmware, hence all models that can run wired-16 support AnyConnect, EXCEPT the MX64/65 models. Work is still in progress to support these models.

5. Can I use AnyConnect profiles?
   Yes, see the AnyConnect Profiles section. Only VPN profiles can be pushed via the MX. Others, like Umbrella profiles, will not be pushed via the MX.

6. Can I configure different split-tunnel rules/VLANs/IP address pools for different sets of users?
   No, not at the moment. However, you can use group policies when authenticating with RADIUS to apply access policies to a user or groups of users on authentication.

7. Can I do certificate-based authentication?
   Yes, as a combination with username and password. See the certificate-based authentication section. Certificate-only authentication is not supported at this time.

8. Where can I download the AnyConnect client?
   On the AnyConnect Settings page on dashboard in the Client Connection section or on cisco.com.

9. How can I provide feedback on this feature?
   Email meraki-anyconnect-beta@cisco.com or via the “make a wish” button on dashboard with “AnyConnect BETA” keyword.

10. What are the current caveats/known issues with the AnyConnect feature & firmware?
    See caveats section

11. Which features are supported? Any plans to support Umbrella, posture scan, 802.1x, etc?
    VPN Only. Other AnyConnect modules that do not require additional server support can be used as well. e.g. DART, Umbrella. This module must be deployed and configured separately as the MX does not support web launch, client software deployment, or update at this time. See AnyConnect on ASA vs. MX for more details. Please email meraki-anyconnect-beta@cisco.com if you have any questions.

12. Is IKEv2 supported on the MX when using AnyConnect?
    No.

13. Can I run L2TP/IPsec client VPN and AnyConnect VPN simultaneously on the MX?
    Yes.

14. Can I connect to the inside interface of the MX with AnyConnect? e.g. connect to the MX from the LAN side?
    No, only connections on the WAN side/outside interface are supported at this time.

15. When will AnyConnect GA?
    This feature is firmware dependent, this means AnyConnect will GA when MX 16.X becomes GA.
    

Objective

The objective of this document is to show you how to configure AnyConnect VPN connectivity on the RV34x Series Router.

Advantages of using AnyConnect Secure Mobility Client:

1. Secure and persistent connectivity
2. Persistent security and policy enforcement
3. Deployable from the Adaptive Security Appliance (ASA) or from Enterprise Software Deployment Systems
4. Customizable and translatable
5. Easily configured
6. Supports both Internet Protocol Security (IPSec) and Secure Sockets Layer (SSL)
7. Supports Internet Key Exchange version 2.0 (IKEv2.0) protocol

Introduction

A Virtual Private Network (VPN) connection allows users to access, send, and receive data to and from a private network by means of going through a public or shared network such as the Internet but still ensuring secure connections to an underlying network infrastructure to protect the private network and its resources.

A VPN client is software that is installed and ran on a computer that wishes to connect to the remote network. This client software must be set up with the same configuration as that of the VPN server such as the IP address and authentication information. This authentication information includes the username and the pre-shared key that will be used to encrypt the data. Depending on the physical location of the networks to be connected, a VPN client can also be a hardware device. This usually happens if the VPN connection is used to connect two networks that are in separate locations.

The Cisco AnyConnect Secure Mobility Client is a software application for connecting to a VPN that works on various operating systems and hardware configurations. This software application makes it possible for remote resources of another network become accessible as if the user is directly connected to his network, but in a secure way. Cisco AnyConnect Secure Mobility Client provides an innovative new way to protect mobile users on computer-based or smart-phone platforms, providing a more seamless, always-protected experience for end users and comprehensive policy enforcement for IT administrator.

On the RV34x router, starting with firmware version 1.0.3.15 and moving forward, AnyConnect licensing is not necessary. There will be a charge for client licenses only.

For additional information on AnyConnect licensing on the RV340 series routers, please see the article on: AnyConnect Licensing for the RV340 Series Routers.

Applicable Devices | Firmware Version

• Cisco AnyConnect Secure Mobility Client | 4.4 (Download latest)
• RV34x Series | 1.0.03.15 (Download latest)

Configure AnyConnect VPN Connectivity on the RV34x

Configure SSL VPN on the RV34x

Step 1. Access the router web-based utility and choose VPN > SSL VPN.

Step 2. Click the On radio button to enable Cisco SSL VPN Server.

Mandatory Gateway Settings

The following configuration settings are mandatory:

Step 3. Choose the Gateway Interface from the drop-down list. This will be the port that will be used for passing traffic through the SSL VPN Tunnels. The options are:

• WAN1
• WAN2
• USB1
• USB2

Note: In this example, WAN1 is chosen.

Step 4. Enter the port number that is used for the SSL VPN gateway in the Gateway Port field ranging from 1 to 65535.

Note: In this example, 8443 is used as the port number.

Anyconnect Vpn Configuration Cli

Step 5. Choose the Certificate File from the drop-down list. This certificate authenticates users who attempt to access the network resource through the SSL VPN tunnels. The drop-down list contains a default certificate and the certificates that are imported.

Note: In this example, Default is chosen.

Step 6. Enter the IP address of the client address pool in the Client Address Pool field. This pool will be the range of IP addresses that will be allocated to remote VPN clients.

Note: Make sure that the IP address range does not overlap with any of the IP addresses on the local network.

Note: In this example, 192.168.0.0 is used.

Step 7. Choose the Client Netmask from the drop-down list.

Note: In this example, 255.255.255.128 is chosen.

Step 8. Enter the client domain name in the Client Domain field. This will be the domain name that should be pushed to SSL VPN clients.

Note: In this example, WideDomain.com is used as the client domain name.

Step 9. Enter the text that would appear as login banner in the Login Banner field. This will be the banner that will be displayed each time a client logs in.

Note: In this example, Welcome to Widedomain! is used as the Login Banner.

Optional Gateway Settings

The following configuration settings are optional:

Step 1. Enter a value in seconds for the Idle Timeout ranging from 60 to 86400. This will be the time duration that the SSL VPN session can remain idle.

Note: In this example, 3000 is used.

Step 2. Enter a value in seconds in the Session Timeout field. This is the time it takes for the Transmission Control Protocol (TCP) or User Datagram Protocol (UDP) session to time out after the specified idle time. The range is from 60 to 1209600.

Note: In this example, 60 is used.

Step 3. Enter a value in seconds in the ClientDPD Timeout field ranging from 0 to 3600. This value specifies the periodic sending of HELLO/ACK messages to check the status of the VPN tunnel.

Note: This feature must be enabled on both ends of the VPN tunnel.

Note: In this example, 350 is used.

Step 4. Enter a value in seconds in the GatewayDPD Timeout field ranging from 0 to 3600. This value specifies the periodic sending of HELLO/ACK messages to check the status of the VPN tunnel.

Note: This feature must be enabled on both ends of the VPN tunnel.

Note: In this example, 360 is used.

Step 5. Enter a value in seconds in the Keep Alive field ranging from 0 to 600. This feature ensures that your router is always connected to the Internet. It will attempt to re-establish the VPN connection if it is dropped.

Note: In this example, 40 is used.

Step 6. Enter a value in seconds for the duration of the tunnel to be connected in the Lease Duration field. The range is from 600 to 1209600.

Note: In this example, 43500 is used.

Step 7. Enter the packet size in bytes that can be sent over the network. The range is from 576 to 1406.

Note: In this example, 1406 is used.

Step 8. Enter the relay interval time in the Rekey Interval field. The Rekey feature allows the SSL keys to renegotiate after the session has been established. The range is from 0 to 43200.

Note: In this example, 3600 is used.

Step 9. Click Apply.

Configure Group Policies

Step 1. Click the Group Policies tab.

Step 2. Click the Add button under the SSL VPN Group Table to add a group policy.

Note: The SSL VPN Group table will show the list of group policies on the device. You can also edit the first group policy on the list, which is named SSLVPNDefaultPolicy. This is the default policy supplied by the device.

Step 3. Enter your preferred policy name in the Policy Name field.

Note: In this example, Group 1 Policy is used.

Step 4. Enter the IP address of the Primary DNS in the field provided. By default, this IP address is already supplied.

Note: In this example, 192.168.1.1 is used.

Step 5. (Optional) Enter the IP address of the Secondary DNS in the field provided. This will serve as a backup in case the primary DNS failed.

Note: In this example, 192.168.1.2 is used.

Step 6. (Optional) Enter the IP address of the primary WINS in the field provided.

Note: In this example, 192.168.1.1 is used.

Step 7. (Optional) Enter the IP address of the secondary WINS in the field provided.

Note: In this example, 192.168.1.2 is used.

Step 8. (Optional) Enter a description of the policy in the Description field.

Note: In this example, Group Policy with split tunnel is used.

Step 9. (Optional) Click on a radio button to choose the IE Proxy Policy to enable Microsoft Internet Explorer (MSIE) proxy settings to establish VPN tunnel. The options are:

• None - Allows the browser to use no proxy settings.
• Auto - Allows the browser to automatically detect the proxy settings.
• Bypass-local - Allows the browser to bypass the proxy settings that are configured on the remote user.
• Disabled - Disables the MSIE proxy settings.

Note: In this example, Disabled is chosen. This is the default setting.

Step 10. (Optional) In the Split Tunneling Settings area, check the Enable Split Tunneling check box to allow Internet destined traffic to be sent unencrypted directly to the Internet. Full Tunneling sends all traffic to the end device where it is then routed to destination resources, eliminating the corporate network from the path for web access.

Step 11. (Optional) Click on a radio button to choose whether to include or exclude traffic when applying the split tunneling.

Note: In this example, Include Traffic is chosen.

Step 12. In the Split Network Table, click the Add button to add split Network exception.

Step 13. Enter the IP address of the network in the field provided.

Note: In this example, 192.168.1.0 is used.

Step 14. In the Split DNS Table, click the Add button to add split DNS exception.

Step 15. Enter the Domain name in the field provided and then click Apply.

Verify AnyConnect VPN Connectivity

Step 1. Click on the AnyConnect Secure Mobility Client icon.

Step 2. In the AnyConnect Secure Mobility Client window, enter the gateway IP address and the gateway port number separated by a colon (:), and then click Connect.

Note: In this example, 10.10.10.1:8443 is used. The software will now show that it is contacting the remote network.

Step 3. Enter your server username and password in the respective fields and then click OK.

Note: In this example, Group1 user is used as the Username.

Step 4. As soon as the connection is established, the Login Banner will appear. Click Accept.

The AnyConnect window should now indicate the successful VPN connection to the network.

Step 5. (Optional) To disconnect from the network, click Disconnect.

You should now have successfully configured AnyConnect VPN connectivity using an RV34x Series Router.

View a video related to this article..