Add static route to allow VPN users to connect to their workstations

[Roey1984]

Hello

I configured the Meraki VPN for our users.

The VPN subnet is: 192.168.120.1/24

Client's workstations subnet is: 192.168.110.1/24

Once they connect successfully to the VPN, they are unable to reach their workstations (Routing issue, it seems)

Do I need to add a Static Route in the MX?

Attached is a picture of what I need to configure; I want to ensure I`m configuring it correctly.

Thank you!

[Brash]

Adding the route you provided the screenshot of is telling the MX that in order to reach the VPN subnet, it should send traffic to the client workstation subnet, which from my understanding is not what you're trying to achieve.

Essentially, the MX needs to know how to reach the workstation subnet (Eg. Has a vlan interface for that subnet, or a static route of how to get there).

Similarly, the default gateway of the workstation subnet needs a route to know that it can get to the VPN subnet via the MX.

[Roey1984]

Hey Brash

Thank you for your reply.

All Workstations reside in the 192.168.100.x subnet (VLAN 1)

Once a client connects from home, he gets an IP from subnet 192.168.110.x.

I understand that my configuration isn't correct.

I also don't have any dedicated VLAN for the VPN (Under Routing); I only have the default one.

Do I need to add here the VPN subnet? or it`s enough for the "Client VPN" page to configure it?

Adding pictures to show my current configuration

[alemabrahao]

If the MX is the gateway of this network there is no need to create statistical routes, I think you are complicating things.

Have you already checked that the Windows firewall is not blocking remote access?

Try disabling Window firewall.

[Roey1984]

Thanks, Alemabrahao

It seems that users need to add a route on their personal device before connecting to the VPN.

But, they want to connect to the end station only ( and not route all traffic through the VPN)

According to Meraki:

"Cisco Meraki Client VPN only establishes full-tunnel connections, which will direct all client traffic through the VPN to the configured MX. As such, any content filtering, firewall or traffic shaping rules will apply to the VPN client's outbound traffic."

Do you think I can enable Split tunnel in my MX75?

[ww]

Its not a mx setting but a client configuration.

@PhilipDAth  made a script that could help

https://www.ifm.net.nz/cookbooks/meraki-client-vpn.html

[alemabrahao · Accepted solution]

The routing will work no matter if it's full tunnel or not, and no, there's no need to create routes on the workstation.

[PhilipDAth]

>It seems that users need to add a route on their personal device

Windows, no.  Apple Mac, yes.