ECMS Practice Question - Jun 4th

[SandroZ]

It is that time of the week, were Friday and the ECMS practice question meet in the Meraki community!

Comment below with what you think is the correct answer and remember: if you like the question or the ECMS questions initiative, leave a kudo.

See you in a week with the correct answer!

ECMS practice question

A customer has 3 MX security appliances deployed in 3 different locations, All the MX’s are in Routed mode and participate in the VPN topology as hubs. MX 1 and MX 2 report no issue in the dashboard, while MX 3 reports a “NAT unfriendly” warning message in the VPN status page.

Which of the following might be causing the issue?

1. MX 1 is behind an upstream device that is rewriting the source port when trying to establishing the VPN tunnel with MX 3
2. MX 3 is behind an upstream device that is rewriting the destination port when communicating with the two VPN cloud registry
3. MX 3 NAT functionality for the LAN to WAN traffic is not configured properly 
4. MX 3 is behind an upstream device the is rewriting different source port when communicating with the two VPN cloud registry 

P.S. We will be sharing new practice questions weekly! If you'd like to receive updates when we do, click the "ECMS Practice" label below and then "Subscribe”

Here you can find previous questions

[wfoteping2101]

A is the answer.

VPN status page reports an unfriendly NAT or disconnected from VPN Registry

If the Security & SD-WAN > Monitor > VPN status page for a given network reports either "NAT type: Unfriendly" or "VPN Registry: Disconnected", there is likely a device upstream of the MX for that site that is preventing AutoVPN from working correctly.

• NAT type: Unfriendly indicates that the upstream NAT won't allow the MX to use UDP hole punching to form the tunnel. It is recommended to set NAT traversal to Manual: Port forwarding to bypass this issue.

Site-to-Site VPN Troubleshooting - Cisco Meraki

[Bruce]

That’s a good one, but tricky. I’m going with D.

[KarstenI]

Yes, really a good one, but after thinking about it all but one answer can be eliminated:

Spoiler

a) It has to be something with MX 3 that communicates to the internet, not MX1

b) Destination ports are never rewritten (at least not for internet-bound communication)

c) It is traffic that is originated by the MX, the NAT config is not relevant here

d) The hole-punching needs the source-port to stay the same, so this is the correct answer

[cmr]

A well written question this week with answers that really make you think.  Have to agree with @Bruce and @KarstenI here 🙂

[Inderdeep]

@SandroZ : Its tricky, yes.. I will go with D

[SandroZ]

It was not my intention to trick anybody but sometimes to not give away the answer the wording might result convoluted 🙃

The correct answer is D

The NAT unfriendly event is triggered by inconsistent information (port/IP address) between multiple VPN Registry

https://documentation.meraki.com/MX/Site-to-site_VPN/Meraki_Auto_VPN_-_Configuration_and_Troubleshoo...

[Inderdeep]

@SandroZ : we know your tricks and we got the right answers 😀

Thanks for these initiatives !