We're wrapping up a large enterprise network project and are deploying Cisco Secure Client VPN for employees who work off-site. The plan is for users to authenticate with their Active Directory accounts, and the Meraki appliance is on the same subnet as the domain controller.
What I'm unsure about is how to limit VPN access to only approved users. Ideally, I'd place those users in a dedicated Active Directory security group and have the VPN authenticate and authorize based on that group, but I don't see an obvious way to configure group-based access in the Meraki dashboard.
I'm considering alternatives such as setting up RADIUS, using organizational units or separate domains, or introducing another identity service. Am I overlooking a straightforward way to use an AD group for VPN authorization?
3 Answers
If Microsoft 365 or Entra ID is available, SAML is usually the cleaner approach. You can combine it with conditional-access policies and MFA, then control access through the identity provider instead of trying to make the VPN appliance handle all the authorization logic.
Since VPN access is an important entry point into the network, don’t overlook MFA. Even if direct AD authentication works for the initial deployment, moving toward SAML with conditional access and MFA would give you better control over who can connect and under what conditions.
The company is going through a period of growth and has a mix of established and newer services, so we’re working with what’s currently available. MFA and SAML are likely part of the future design.
A common design is to use an AD security group specifically for VPN users, with RADIUS or another directory integration handling the authentication and group-membership check. The existing AD group may already be used indirectly by another service, so it’s worth checking exactly what authentication method the Meraki configuration supports before creating OUs or separate domains.
Entra isn’t set up yet, and the current Microsoft 365 users don’t line up with the VPN users. It does sound like SAML may be the better long-term direction as the environment grows.