We're a small business running Meraki MX devices across several offices. Remote creative users need fast, reliable VPN tunnels for navigating and transferring large files, and Meraki's IKEv2/IPsec client VPN performs much better for that than TLS/DTLS-based AnyConnect.
The problem is that Meraki currently doesn't provide MFA or client-certificate validation for IKEv2/IPsec. At the moment, the MX devices authenticate against an NPS server in Azure joined to an Entra Domain Services domain, but we'd prefer not to maintain a traditional AD-style environment. We're otherwise heavily invested in Microsoft 365, Entra ID, Windows 11 Business, Intune, Teams, and Office.
Is there an affordable RADIUS-compatible service or tool that can integrate with Entra ID or Entra Domain Services and perform MFA before returning a successful authentication response to the Meraki MX?
5 Answers
Duo is probably the simplest commercial option to investigate. It can sit in the authentication path and add MFA to RADIUS-based VPN access without requiring you to build out another full directory environment. Pricing is generally reasonable for smaller deployments, though you’ll want to confirm that the exact Meraki IKEv2 and RADIUS flow you’re using is supported.
Since you’re already heavily invested in Microsoft, first check whether your existing Entra licensing can handle the authentication design you want. Microsoft MFA can work with certain VPN and RADIUS architectures, but it is not automatically available for every Meraki IKEv2 setup. The exact combination of NPS, the MFA extension, Entra ID or Domain Services, and the MX’s supported authentication method matters, so confirm the current vendor support matrix rather than assuming AnyConnect documentation applies to IKEv2.
A low-cost alternative is to run FreeRADIUS yourself on a small, hardened cloud instance and integrate it with your identity provider or an MFA plugin. It keeps licensing costs down, but it does add operational overhead: patching, monitoring, backups, certificate management, and making sure the MFA challenge works correctly with the MX’s RADIUS behavior.
If you have the appropriate Microsoft licensing, one route is to use Intune Cloud PKI for client certificates and pair it with a hosted RADIUS provider. That can provide stronger device-based authentication than relying only on usernames and passwords, while avoiding the need to operate your own AD domain. Verify that the certificate and EAP method are compatible with the Meraki IKEv2 client configuration before committing.
Cloudflare’s Zero Trust products may also be worth evaluating if you have fewer than 50 users. The free tier has limitations, and it isn’t a direct replacement for Meraki’s native IKEv2 RADIUS authentication, but it could provide a different access model that achieves the same goal for some remote-work use cases. Test file-transfer performance and application compatibility carefully before switching.
Duo is owned by Cisco now, and for a relatively small user count it may not be too expensive. Check whether you can purchase it directly rather than assuming it has to come through an MSP.