Auto VPN between MX/Z3 and AWS vMX100

SOLVED
JQ
Here to help

Auto VPN between MX/Z3 and AWS vMX100

Hi all,

Recently deployed 3 vMX100 on AWS and a few MX68 and Z3.  AutoVPN are NOT establishing connection to the vMX100 (all 3 PVCs) when the MX68 and Z3 are on broadband networks (test at 3 locations), Spectrum, Xfinity, and Version Fios.  AutoVPN does established connections between the MX68 and Z3.  If I connected the Z3 in the office network, all AutoVPN are established.  Is this an issue with AWS or Meraki?  Package capture doesn't shown the return traffic from AWS.  Have anyone experienced this issue and if have found the root cause.  Thank you.

1 ACCEPTED SOLUTION
JQ
Here to help

I rebuilt the vMX100 with an elastic IP, as AWS unfriendly NAT did not working out well without the elastic IP

View solution in original post

6 REPLIES 6
PhilipDAth
Kind of a big deal
Kind of a big deal

I've never had any issues myself.

 

My best guess is you have an AWS security policy not allowing the traffic.

PhilipDAth
Kind of a big deal
Kind of a big deal

Does the dashbard show that the vMX is online?

Does the dashboard show that the vMX is registered as a VPN end point?

Thanks for the input.  Yes, the vMX are online, as others MX68 at satellite offices are established VPN and passing traffic.  Only if I take the Z3 home connected to my xfinity modem (and Verizon Fios and Spectrum broadband in Columbus) that the VPN NOT established to AWS vMX100.  But it does established to others MX68 sites.

NolanHerring
Kind of a big deal

Any logs showing specific errors for those Z3 not being able to talk to vMX?

Also, you don't by any chance have any firewall rules allowing those specific sites only (assuming they have static IPs on the MX68s, where as the Z3 are going to be dynamic IP) and blocking anything else etc.
Nolan Herring | nolanwifi.com
TwitterLinkedIn

On the Meraki side, there are no firewalls rules.  There are firewall rules on the broadband modems (I assume), but the Z3 are able to established VPN to other MX68.  So the broadband modems does allow UDP traffic for MX68 VPN connections.  

 

So the three locations experienced issue are using 192.168.0.0 and NATed on the modem.  The corporate networks are using 10.0.0.0.  Where on AWS vMX security policy that control the peer WAN uplink private IPs?

JQ
Here to help

I rebuilt the vMX100 with an elastic IP, as AWS unfriendly NAT did not working out well without the elastic IP

Get notified when there are additional replies to this discussion.
Welcome to the Meraki Community!
To start contributing, simply sign in with your Cisco account. If you don't yet have a Cisco account, you can sign up.
Labels