vMX - Cant communicate with onsite networks

[jweal8r]

I have been playing with the vMX in AWS, deployed using the cloud integration tool.  I have the vpc and subnets setup, the route tables have been updated to allow communication back to my internal network.  I can ping an EC2 instance I stood up from my side of the network, but then from the EC2 instance I cant ping back to an internal ip... what am I missing?  

I have the vMX in passthrough or vpn concentrator mode

The firewall on the vMX is set to allow any inbound and out

Site to Site is on, and the aws vpc subnet is enabled

[alemabrahao]

Do you have any firewall on both sides AWS or local network?

[jweal8r]

not sure I understand your question, there are firewalls but they are set to allow everything at the moment

[GreenMan]

You don't say much about your Spoke MX setup...   Are the VLANs at the spoke set to VPN enabled, for example?   What do you see in the MX Route table at each end?

[jweal8r]

On the Site to Site VPN page I have Hub(Mesh) selected

Under VPN Settings I have the AWS VPC subnet listed with vpn enabled.

The route table on the MX shows Green status routes into ALL of my different subnets

in AWS there are routes back to the subnet I am trying to reach. 

[GreenMan]

But the main purpose of VMX is to make your AWS resources available to remote locations with MX appliances, via secure tunnels.   What can you see from the remote MX(s)?

[jweal8r]

thats what I am trying to accomplish yes.   But does it go both ways?   Should I be able to access resources on my internal network from the AWS resources? because that is where I am having trouble

[GreenMan]

Yes - provided you have no VPN firewall rules configured, you should be able to establish flows in either direction.   You may be best off raising a case with Meraki Support;  having visibility of the Dashboard will be be a massive help to anyone trying to troubleshoot with you

[PhilipDAth]

>the EC2 instance I cant ping back to an internal ip

Try temporarily disabling Windows Firewall on the internal machine to make sure it is not blocking the ping.

Make sure the on-premise MX has the VLAN where the internal machine is located included in AutoVPN.