Recovering Access to Accounts Protected by Two-Factor Authentication

As per Meraki documentation 'Client VPN does not natively support two-factor auth, a third-party solution is required for this configuration', which basically means that the system can only have one authentication source. Auto VPN™ self-configuring site-to-site VPN; Client VPN (IPSec L2TP), limit 2 authorized users (with Meraki-hosted authentication only) VLAN and DHCP services; 802.1x wired port authentication; Static routing; User and device quarantine; Integrated Wireless 4 SSIDs; 2 × 802.11a/b/g/n/ac (2.4Ghz or 5 Ghz), 2x2 MU-MIMO with 2 spatial streams.

Two Factor Authentication (TFA) is an important security mechanism, and cannot be disabled by Cisco Meraki without positively identifying the account owner. There are two methods available to ensure access is not lost: a backup phone number (with SMS auth), and a list of one-time codes (with Google Authenticator).

The two methods above are the primary options for disabling or temporarily bypassing two-factor authentication. If these methods cannot be utilized for any reason, the only alternative is to provide proof of identity after contacting Cisco Meraki Technical Support. There are two methods to request removal of SMS and Google Authentication for TFA.

Please note that 2FA removal requests cannot be resolved via our support phone lines. 2FA disablement needs to be requested and processed by the admin email that needs assistance via a Meraki case for security purposes. See steps on recovering access below.

Method 1:

1. Open a case by emailing licensing@meraki.com.
   - This email must be sent from the email address of the account TFA is to be disabled on.
   - It must include the full name of the organization that the account resides in.
2. A second organization administrator must comment on the case through Dashboard granting approval to disable TFA on the account.
   - Email or phone approval is not acceptable for this. The approval must come as a comment on the case.
   - This permission can be granted only by an organization administrator with Full access.

Sonicwall Global Vpn Client 2fa

Method 2:

Meraki Vpn Client Setup

Meraki Client Vpn Authentication

Alternatively, if a second organization administrator with full access does not exist or is otherwise unavailable:

Meraki Client Vpn 2fa Download

1. Open a case by emailing licensing@meraki.com.
   - This email must be sent from the email address of the account TFA is to be disabled on.
2. Once in communication with a Cisco Meraki Support Specialist, explain that TFA needs to be disabled for the account and provide the requested documentation.
3. The Support Operations Specialist will request more information about the organization and its contents and settings to verify the validity of the request.
4. Once this step has been completed, a Cisco Meraki Support Specialist will provide you a document which must be signed, notarized, and mailed to Cisco Meraki Headquarters (address found below).
   • When this is received by support, it will then be scanned and attached to the case before TFA is disabled.
   • It is strongly recommended to send this letter with tracking, in case of postal issues.
   • Unless otherwise specified by the Support Ops Team, use the following address format:
     Cisco Meraki- Support Operations
     500 Terry A Francois Blvd
     4th Floor, C/O [SUPPORT OPS SPECIALIST'S NAME]
     San Francisco, CA 94158