Connectivity

[Shubh3738]

Hi All,

We are able to ping Private cloud's MX 250's  Vlan from the DC Location but unable to ping Data Centre VLAN from the DC Location.

MX 250 configured as an routed mode.

Please guide.

[rhbirkelund · Accepted solution]

Have you added 10.130.x.x as a static route on your MX250, with the Fortigate as next hop? And advertised it into your VPN towards DC locations?

Otherwise you might need to look into if the Fortigate is blocking traffic.

[PhilipDAth]

Is the VMX configured in "VPN Concentrator" mode rather than "Routed" mode?  This kind of config will only work in "VPN Concentrator" mode.

https://documentation.meraki.com/MX/Other_Topics/vMX_NAT_Mode_Use_Cases_and_FAQ#NAT_Mode_on_the_vMX_...

"vMXs in NAT mode will not advertise subnets that are available on the public/private cloud, so spoke MXs will have to send all their traffic to the vMX, which will then NAT the traffic and send it across its WAN interface into the public/private cloud environment. 

As vMXs in NAT mode function as stateful firewalls, any traffic that is initiated from the cloud environment will be dropped due to the lack of a corresponding flow initiated from the other end, be it Auto-VPN or Client VPN. 

Spokes will have to full tunnel all their traffic to a vMX in NAT mode, if they want to access resources inside the public/private cloud."