It is also not possible to use a DHCP-server for address assignment. On the ASA you can configure different IP subnets for different user groups, this is not possible with the MX and all users share the same VPN-subnet.

The Authentication Protocol is вЂњPAP_ASCIIвЂќ, so there is no password-management for Anењњonnect-users on the MX. After increasing the RADIUS timeout (default 3 seconds) MFA with the DUO authentication proxy directly worked like a charm. There is no dedicated MFA-Config, but with RADIUS we can access any MFA server of our choice. But you can also use double authentication (certificate and AAA) which I didnвЂ™t test yet. Having a default config (that can not be tuned) that gives a вЂњBвЂќ is a little bit awkward nowadays. SSLLabs only rates the VPN-Server with a вЂњBвЂќ which is not state of the art any more. But there are a lot of non-FS algorithms enabled. The MX also only uses TLS/DTLS 1.2 which is great. On all my ASA implementations, I only enable TLS 1.2 with next-generation encryption and disable everything that has no Forward Secrecy (FS). ItвЂ™s also not possible to import your own certificate. I expected that they implement an automatic LetвЂ™s Encrypt enrolment, but at least at the moment that is not possible. The documentation says that it should auto-renew before it expires. It comes from the QuoVadis Root CA which should be trusted on all relevant systems and is valid for three months. The certificate is automatically deployed for the DDNS hostname of the MX. What is different to an Anењњonnect implementation on the ASA Certificate Enrollment Thats all that has to be done and it is working. Configure the Anењњonnect VPN subnet, Nameservers and DNS Suffix.Configure the Authentication (RADIUS, Meraki Cloud or AD).Upload a client profile (optional, but I would always do so).Change or accept the Anењњonnect-port (default 443) and login-banner (default вЂњYou have successfully connected to client vpn.вЂќ).The configuration is Meraki-easy as expected. Anyconnect Meraki Mx Player Configuration With this device the Anењњonnect VPN was working. The next try was my MX68 (which I got from Meraki for my recognition as a Meraki All-Star, thanks again for that!). Announcing Cisco Anењњonnect VPN with Meraki MX. MX Server certificate: The Anењњonnect server on the MX uses TLS for tunnel negotiation, hence it needs a server identity certificate.Currently, when Anењњonnect is enabled, the MX will automatically initiate a certificate-signing request to get a publicly trusted identity certificate this is entirely transparent to the dashboard administrator. Well, early Beta вЂ¦ДЄnењњonnect Server Settings. Either it kept a self-signed-certificate or did not enable the Anењњonnect server at all. My first try was with a Meraki Z3 which should be supported, but that device did not want to enroll a public certificate. It was first announced at Cisco Live 2015 (at least that is where I first heard of it) and after no more than six years the first public beta (v16.4) is available. The support for Anењњonnect VPNs is probably one of the most wanted features for Meraki customers.

Meraki anyconnect