cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Auto VPN between MX/Z3 and AWS vMX100

SOLVED
JQ
Here to help

Auto VPN between MX/Z3 and AWS vMX100

Hi all,

Recently deployed 3 vMX100 on AWS and a few MX68 and Z3.  AutoVPN are NOT establishing connection to the vMX100 (all 3 PVCs) when the MX68 and Z3 are on broadband networks (test at 3 locations), Spectrum, Xfinity, and Version Fios.  AutoVPN does established connections between the MX68 and Z3.  If I connected the Z3 in the office network, all AutoVPN are established.  Is this an issue with AWS or Meraki?  Package capture doesn't shown the return traffic from AWS.  Have anyone experienced this issue and if have found the root cause.  Thank you.

1 ACCEPTED SOLUTION

Accepted Solutions
JQ
Here to help

Re: Auto VPN between MX/Z3 and AWS vMX100

I rebuilt the vMX100 with an elastic IP, as AWS unfriendly NAT did not working out well without the elastic IP

6 REPLIES 6
Kind of a big deal

Re: Auto VPN between MX/Z3 and AWS vMX100

I've never had any issues myself.

 

My best guess is you have an AWS security policy not allowing the traffic.

Kind of a big deal

Re: Auto VPN between MX/Z3 and AWS vMX100

Does the dashbard show that the vMX is online?

Does the dashboard show that the vMX is registered as a VPN end point?

JQ
Here to help

Re: Auto VPN between MX/Z3 and AWS vMX100

Thanks for the input.  Yes, the vMX are online, as others MX68 at satellite offices are established VPN and passing traffic.  Only if I take the Z3 home connected to my xfinity modem (and Verizon Fios and Spectrum broadband in Columbus) that the VPN NOT established to AWS vMX100.  But it does established to others MX68 sites.

Kind of a big deal

Re: Auto VPN between MX/Z3 and AWS vMX100

Any logs showing specific errors for those Z3 not being able to talk to vMX?

Also, you don't by any chance have any firewall rules allowing those specific sites only (assuming they have static IPs on the MX68s, where as the Z3 are going to be dynamic IP) and blocking anything else etc.
Nolan Herring | nolanwifi.com
TwitterLinkedIn
JQ
Here to help

Re: Auto VPN between MX/Z3 and AWS vMX100

On the Meraki side, there are no firewalls rules.  There are firewall rules on the broadband modems (I assume), but the Z3 are able to established VPN to other MX68.  So the broadband modems does allow UDP traffic for MX68 VPN connections.  

 

So the three locations experienced issue are using 192.168.0.0 and NATed on the modem.  The corporate networks are using 10.0.0.0.  Where on AWS vMX security policy that control the peer WAN uplink private IPs?

JQ
Here to help

Re: Auto VPN between MX/Z3 and AWS vMX100

I rebuilt the vMX100 with an elastic IP, as AWS unfriendly NAT did not working out well without the elastic IP

Welcome to the Meraki Community!
To start contributing, simply sign in with your Cisco account. If you don't yet have a Cisco account, you can sign up.