vMX in AWS site-to-site VPN and Anyconnect

[netguy11]

Hello,

I'm trying to set up a following. I have test vMX-S deployed in AWS. I can see it on the dashboard in my test organization.  All looks good from this point. SW ver is  16.15. 

I have two issues:

1) I can connect with remote VPN client (Anyconnect), but then in full tunneling mode traffic is not going out to the Internet. Is this expected behavior from vMX?

2) I'm also trying to establish 3rd party site to site VPN with a MX in another organization (this is for PoC, that's why I'm keeping it separately and not using AutoVPN), but tunnel is not coming up. Traffic flow is: remote VPN connected to vMX - 3rd party VPN - MX - LAN. Trying to ping from AnyConnect to branch LAN to activate the tunnel, but I'm not sure if those packets are actually going to the other end.  On vMX I can see some 500 & 4500 packets in the capture. Does anyone successfully deployed such scenario? Any hints would be more than welcome 🙂

[PhilipDAth]

>1) ... Is this expected behavior from vMX?

This is the expected behaviour for AWS (nothing to do with Meraki).  AWS will only NAT traffic heading out to the Internet from VPC connected subnets.  It will not NAT traffic from any other routes (such as the AnyConnect address pool).

Are you sure you have the AnyConnect pool in the third party encryption domain?

[netguy11]

Hi Philip,

Thanks for the replay. In my case VPC subnet is 10.x.0.0/16. I have vMX in 10.x.0.0/24 and vpn pool is 10.x.1.0/24. So in theory both /24s are part of the /16 VPC subnet. Should that work?

Yes, I have the VPN pool in 3rd party enc domain. I got spare Z3C yesterday. I will test with AutoVPN and check if there is a difference.

EDIT:

Just tested with AutoVPN and communication from Anyconnect to branch works fine with split tunnel mode. For now only full tunnel is the issue.

[Chad3_23]

Hello Netguy11,

Trying to test out Anyconnect connecting to a Vmx in AWS and I can't get it to connect.  I have allowed port 443 in our security group but nothing.    Did some packet capturing and it seems like the traffic isn't making it to the Vmx.  Any suggestions or thoughts?  Thanks!

[PhilipDAth]

You need to allow both UDP and TCP 443.

If you point your web browser to the VMX using HTTPS (which will fail - but it will generate traffic) - do you see it hitting the VMX in a packet capture?  If not - you must have an issue on the AWS side.

The VMX should be in a "public" segment, and should have a public IP address (elastic IP) NATed directly to it.

[Chad3_23]

Thank you for the information.   I am not seeing that traffic so I will keep investigating.    

[Chad3_23]

Thanks for the help.  I am now seeing the generated traffic.  I am seeing the traffic being hit on the IP(Elastic IP) in AWS but the public IP on the Meraki portal is different and nothing on that IP.    I tried connecting to it by the Elastic IP and it isn't prompting to connect.   I have allowed udp/tcp 443 on the security group.    Appreciate any help or thoughts.    

[Chad3_23]

Going to add a couple of tips that will maybe help someone in the future. This isn't a complete step by step guide, just some tips that will help.

First get the VMX spun up using this document -

 https://documentation.meraki.com/MX/MX_Installation_Guides/vMX_Setup_Guide_for_Amazon_Web_Services_(...

• Make sure you add the VMX to the public subnet
• Your Ip in the Meraki dashboard should be the same IP as the public IP under the details

Click Client VPN and enable Anyconnect

• Fill in the setting that works for your environment
• - Anyconnect VPN subnet - example 192.168.2.0/24 (Make this different subnet than your VPC)

In AWS go to route tables for the public and private subnets

• Add 192.168.2.0/24  as the destination and target is going to be your Meraki network interface To find Meraki network interface (EC2 -> go to VMX and click networking)

[Stallone]

Hello @Chad3_23 

Can you please help me with a similar issue ?

I also have a tunnel between AWS and my on-premise resources via Meraki vMX, but additionally, I would like to apply some firewall rules in my AWS account, so I added them to a security group that is attached to the ec2 instance, unfortunately, it didn't work for me, traffic still unrestricted, so it looks like that security group not work for inbound traffic

[Chad3_23]

Hey @Stallone 

Just to verify, your on-premise traffic can't send any traffic to your ec2 instance?   It is all blocked?