AT&T Installing Meraki MX85 for their routers and causing Client AnyConnect connection for users

[rhamersley]

I updated my AT&T circuit to allow our company to adjust bandwidth when our company needed.   Our company installed the new ASEoD circuit.  With the new circuit installed with the new AT&T Meraki MX85 our users are now unable to VPN into our Meraki MX 84 security appliance that sits behind the AT&T MX 85 device.   

AT&T support has not been helpful in trying different configurations to allow connection through the AT&T MX 85 security appliance to our Meraki MX 84 security appliance that has all our Anyconnect Client VPN configuration on.   

Would any one have suggestions on what kind of configuration I would need to perform on the AT&T Meraki MX 85 security appliance to allow some kind of passthrough to allow our VPN users connect to our Meraki MX 84 appliance were our VPN Client configuration sits on. 

[alemabrahao]

Is this link behind CGNAT?

[rhamersley]

Ciena device is connected to the AT&T Meraki MX85 security appliance, then connected to our Meraki MX84 security appliance were all our VPN Anyconnect client configuration is on.

[alemabrahao]

I suggest you to check with ATT&T if it's  behind CGNAT.

[rhamersley]

Alemabrahae...

Would there be any kind of configuration that you might recommend that might need to be performed on the AT&T Meraki MX85 device that sits in front of our Meraki MX84??

We still have the old AT&T circuit up and running and if I plug that circuit in, all our AnyConnect VPN users connect just fine.   But that has a Cisco Router and connected directly to our Meraki MX84 security appliance.

[PhilipDAth]

You need AT&T to NAT tcp/443 and UDP/443 through to the IP address on the outside of your MX84 (assuming that it now has a private IP address on its WAN interface).

[rhamersley]

Im currently looking at the port forwarding rules on the AT&T Meraki MX85 device. 

Confirmed there is no port forwarding rules.   Just confirming the config...

"Add a port forwarding Rule"

Description - Port 443

Uplink - Internet 1

Protocol - TCP/UDP

Public Port - 443

LAN IP - ????

Local Port - 443

Allow remote IP's - ????

Just confirming what would be the LAN IP - Would that be my internal Default on my internal Meraki MX?

Allow remote IP's would that be set to "Any"??

[PhilipDAth]

The LAN IP would be the IP address on the Internet interface of your MX.  Remote IPs should be "any".

If you have access to the AT&T MX85, and you have an MX84 .... could you just decommission your MX84?