vMX Deployment in Azure

[nlatta42]

Coming across an issue where I cannot traverse network traffic initiated from Azure VM after vMX deployment.

Current vMeraki Config:

Mode: Routed

Client tracking: IP Address

Subnet VLAN-Management - 10.91.2.0/24 next hop 10.91.2.4

vMX LAN - 10.91.2.4

Static route "Azure Servers": 10.92.20.0/24 next hop 10.91.2.4

I have the route table configured in Azure pointing branch office traffic to virtual appliance of 10.91.2.4 with my Azure server subnet associated to the route table.

After testing and configuring my Azure environment, from my branch offices I can reach my Azure resources perfectly fine (ICMP, RDP, Etc.) however, if I am initiating anything from the resources (virtual machine) in Azure to my branch office everything fails. From the vMX stand point I can get across the auto vpn and ping resources in branch offices.

For example, my MX is 10.91.2.4 and my azure resources are on 10.92.20.0/24. My Azure VM can communicate to the vMX just to nothing over the tunnel. I have the vNets peered and have allowed the two subnets over the AutoVPN.  Am I missing a route?

[alemabrahao]

Have you allowed communication inside the azure firewall?

[MyHomeNWLab]

When vMX (Virtual MX) is in Routed Mode (Limited NAT mode), there is no reachability from the Azure side to the branch office side.
This behavior is similar to a typical Router or Firewall, where communication from the WAN (Internet/Untrust) to the LAN (Trust) is discarded.
Please consider using Passthrough or VPN Concentrator Mode.

[Related Documents]
vMX NAT Mode Use Cases and FAQ - Cisco Meraki
https://documentation.meraki.com/MX/Other_Topics/vMX_NAT_Mode_Use_Cases_and_FAQ

vMX Setup Guide for Microsoft Azure - Cisco Meraki
https://documentation.meraki.com/MX/MX_Installation_Guides/vMX_Setup_Guide_for_Microsoft_Azure

[PhilipDAth]

That sounds hard to believe.  So you are saying that traffic that is initiated on the Azure side can't be routed to a VMX in NAT mode and over an AutoVPN tunnel?

That would make this mode terrible.

[Ryan_Miles]

@nlatta42 What was the resolution? I don't see anything in the case other than you closed it.