traffic not getting initiated from IKEv1 for non-meraki tunnel

[Tishman]

Hi Experts

I had created a site-to site tunnel with non-meraki device FTD with IKEv1 tunnel come up but for few traffic selectors traffic is not getting initiated from meraki but it works when initiated from FTD.

MX version 18.211.2

does anyone have any fix  as same is happening with IKEv2 when using FQDN.

[Tony-Sydney-AU]

Hello @Tishman 

Based on what you said, I suspect your Trafic Selectors (TS ; a.k.a. encryption domain) don't match exactly.

I.e.: MX side may have a /24 subnet while the other side has a /25 ; so it works if the other side initiates because MX TS is like a summary route. On the other hand, MX initiating doesn't work because the other side has a /25 more specific TS.

You may want to double-check with the network admin at the other side and make sure both sides are configured with the exact subnets as traffic selector (TS).

[Tishman]

both site A and site B managed by me so traffic selectors are same at both side it is random issue not facing continously 

[Tony-Sydney-AU]

Hi, thanks for checking.

If it is random, maybe it is related to firmware.

Perhaps you can try latest patch in version 18.211.3. I hope you can also upgrade your non-Meraki VPN peer.

Have you checked firmware?

[Knowguy]

Looks like we have the same topic going in multiple locations now, for the latest head on over to https://community.meraki.com/t5/Security-SD-WAN/Traffic-not-getting-initiated-from-IKEv1-and-IKEv2-f... for continued discussion on non-Meraki IKEv1 not initiating traffic over tunnels.

[Tony-Sydney-AU]

Yes, @Knowguy . That discussion is more complete. Firmware 18.211.3 don't fix this behaviour. @Tishman , feel free to post over there.

[Tishman]

Is there any way we can decrpt the pcap files taken for vpn traffic from meraki it will make more picture clear for this issue.