Disclaimer: I don't know a lot about Meraki Firewall authentication; I'm a Duo person.
When someone connects the VPN with a certificate in your config today, is that the only authentication required, or do your users have to enter some credential info as well? If your Meraki firewall does not support chaining authentication sources (auth to A, then auth to B if A succeeds), then Duo 2FA and certificate auth may be mutually exclusive. I have only ever looked at a Meraki MX before, years ago, and to my recollection it did not support chained authentication.
If you can somehow chain cert auth so that it's followed by a Duo RADIUS (like https://duo.com/docs/meraki-radius) or LDAP authentication server, it will not be silent and will need the user to interact and satisfy a Duo MFA request upon connect/reconnect.
We also have a Duo SSO SAML app for MX https://duo.com/docs/sso-meraki-secure-client, but I think that using SAML is an either/or config as well.
Meraki support might be the better contact to confirm if your device supports certificate auth followed by external RADIUS or SAML authentication, or maybe someone else in the user community here knows for sure.
Duo, not DUO.
