AnyConnect VPN and non-Meraki VPN peer

bkrautner
Getting noticed

AnyConnect VPN and non-Meraki VPN peer

Hello,

 

Have a customer where we have set up a non-Meraki VPN peer to a 3rd party provider (3PP) who is using a Fortinet FW. This has been working and 3PP can see devices on the the customer LAN segment on the Meraki MX75.

Recently, customer has requested set up of an AnyConnect VPN using Meraki authentication, which I added.

As per what I would believe to be normal BAU standards, I then enabled AutoVPN for the new AnyConnect service, did a simple test from phone based AnyConnect and established a session. Thinking all was good, left it at that.


Then received message from 3PP that the non-Meraki VPN peer tunnel had gone down. Checked dashboard, and yes it was. Disabled AutoVPN for the AnyConnect service, and tunnel came back up.

Is this a known issue that we can't have a non-Meraki VPN peer and AnyConnect up at the same time?

Regards,

 

Bob

3 Replies 3
MasG
Meraki Employee
Meraki Employee

Hello Bob, 

 

We are currently not aware of a known issue that affects the ability to have a non-Meraki VPN peer and AnyConnect up at the same time. 

We recommend to contact our Technical support for help in troubleshooting the issue. You can open a case by emailing support@meraki.com or call our support line +1 (415) 937‑6671.

PhilipDAth
Kind of a big deal
Kind of a big deal

> then enabled AutoVPN for the new AnyConnect service

 

What would have happened is the remote party would now see the AnyConnect subnet as part of the encryption domain - but they don't have it configured the same way - so the VPN negotiation would now fail.

 

You either need to leave it out of AutoVPN, or ask the remote party to add AnyConnect to the encryption domain for you at the same time as you enable it for AutoVPN.

 

Hello,

 

Thank you for your time and reply. Yes, that’s makes perfect sense. The problem did seem to occur after AutoVPN was enabled for the AnyConnect range. 

 

I will speak to the end customer tomorrow and see which way they would like to proceed. 

Kind regards 

 

Bob Krautner 

Get notified when there are additional replies to this discussion.
Welcome to the Meraki Community!
To start contributing, simply sign in with your Cisco account. If you don't yet have a Cisco account, you can sign up.
Labels