In Meraki AutoVPN, the inner IP header is fully encrypted and encapsulated inside an ESP packet.
Although Meraki does not publish packet‑structure diagrams, their documentation confirms two essential facts:
- AutoVPN uses IPsec ESP for data‑plane encryption.
The UDP ports below are used by Automatic NAT traversal. When peers are directly connected to the Internet with a public IP address and not protected by a transparent firewall or when peers are behind a firewall and NAT that allow all outbound traffic and does not perform load balancing, no further configuration is necessary on upstream security systems. In this case the tunnel should be established and all peers will show up as connected in Dashboard. However in the case that your Cisco Meraki peer resides behind a restrictive firewall the following connection types are required.
To contact the VPN registry:
- Source UDP port range 32768-61000
- Destination UDP port range 9350-9381
For IPsec tunneling:
- Source UDP port range 32768-61000
- Destination UDP port range 32768-61000
meraki_whitepaper_autovpn.pdf
I am not a Cisco Meraki employee. My suggestions are based on documentation of Meraki best practices and day-to-day experience.
Please, if this post was useful, leave your kudos and mark it as solved.
