Azure VPNs

[MJPAGAN]

I was looking into options for a design that has multiple MX65 firewalls that need to connect to an Azure tenant. The official documentation does not mention Meraki as a supported/tested VPN device so I'm wondering if anyone has been able to make it work.

Basic requirements for the design are hub spoke VPN topology but a full mesh would also work.

I know the vMX100 will be available soon but some organizations will find the extra cost of the VM and the Meraki licensing.

What have others done with MXs and Azure?

[PhilipDAth · Accepted solution]

You have to create a "Policy Base VPN" in Azure.  Then you can build the VPN directly from Meraki to Azure.

[Reinout]

Sure you can create a policy based VPN to azure, but be aware that if you require more bandwidth for your VPN or want to add multiple s2s VPNs to azure or add p2s VPNs to azure this policy based VPN is not a solution. Than you need a route based VPN or need to add a vMX100 in azure (which will cost extra)

[Reinout]

Sure you can create a policy based VPN to azure, but be aware that if you require more bandwidth for your VPN or want to add multiple s2s VPNs to azure or add p2s VPNs to azure this policy based VPN is not a solution you want. Than you need a route based VPN or need to add a vMX100 in azure (which will cost extra)

[JohnS]

Azure Policy based VPN only supports one site, so multi site will not work. The new VPNGw1 would support more than 1 site, but it only supports IKEv2 and Meraki only supports IKEv1. so it will not work. 

If you want to use one location as main and route S2S to azure, Meraki does not support that.

The only choice is to use vMX100, however, that does not support CSP model and I have not heard any roadmap on that. 

[PhilipDAth]

Or you use the one of the cheapest options - Strongswan.  It will support as many sites as you want.

http://www.ifm.net.nz/cookbooks/meraki-vpn-to-azure.html

[wey2go]

Still wish Meraki will simply make IKEv2 soon for MX.

[MilesMeraki]

You could also look at deploying the vMX100 inside a Azure VNET. I've not done it with Azure however have set it up within AWS. It's pretty simple,  just requires VPC with a IGW created and then subnets behind the xVM100, just change their route tables to point to the interface of the VMX100. I can imagine the setup is identical in Azure just with the Azure equivalents. 

If you're looking at deploying quite a few Meraki sites, rather than having to manually create VPN's from each of them an vMX100 and Auto-VPN would be the way to go. otherwise if it's a small amount, I don't know if you'd be able to justify the cost (vMX100 license, running costs) etc as effectively it's just working as a VPN concentrator.

[Ducam]

This article worked for me.

https://www.virtualizationhowto.com/2017/08/configure-meraki-to-azure-site-to-site-vpn/

[Mateen]

get ikev2 activeted from meraki support on your MX to use azure route based vpn gateway.

[Synnapex]

I'm wondering if Meraki activates IKEv2, will I be able to connect to Azure VPN gateway configured in a  Route-base mode?

[MattPainter]

Yes. It is not yet on the official Azure supported hardware list but it does work.

[Mateen]

yes, you can.

[Jeizzen]

As of may 2020, I was able to create a connected vpn with Azure that worked by configuring this way :

Azure : routed-based vpn IKEv1

Meraki : Azure preset, but deleting the MD5 in phase 2

[RubenL]

Hi  Jeizzen,

Do you have 2 tunnels(2 remote locations connecting back to Azure) or just one?

[Mateen]

have 6 route based ikev2 tunnels. one from each location connecting back to azure vpn gw.

[Jeizzen]

Hi RubenL

Only one tunnel