Create a Static Route with Cisco MX84

[Clesher]

Hi,

Our client who has a separate network wants to share Internet with us. We are currently using Cisco MX84. They are asking for a WAN static IP address to be routed and not through NAT. I want to give one IP on our LAN IP Block? How do I configure it on Meraki?

Regards,

Clesher 

[BrechtSchamp]

They want to go through your MX? Why not just connect their firewall directly to the provider's router?

[Clesher]

Sorry just beginning to understand this. Basically, they have their own setup. They have router. All they want is for us to provide a static IP address (WAN)  and create a route for them using our Meraki. 

[ww]

you need something like 1:1 nat https://documentation.meraki.com/MX/NAT_and_Port_Forwarding/Port_Forwarding_and_NAT_Rules_on_the_MX

and the other router would use nat on the lan adres you provide

[Clesher]

Sorry, but apparently they don't want it be NATed. They want a  public ip address to be routed not going through NAT.

[ww]

maybe in the future with no nat

https://community.meraki.com/t5/Security-SD-WAN/MX-and-No-NAT-operation/td-p/47287

[PhilipDAth]

Like @BrechtSchamp says, have them plug their firewall into the ISP router - just like you do.

If the ISP doesn't provide a router then you would need to install a switch between the ISP and your MX, and have them plug their firewall into that.

You can't resolve this by adding any routes on your MX.

[Nash]

@PhilipDAth is bang on here. If your ISP didn't provide a device with multiple ports, then a baby switch between the ISP device is what you need. My firm typically uses an MS120-8 for clients already using Meraki equipment, since then we can just manage it from the dashboard.

Pretty easy setup. Say ports 1/2/3 are for Internet access. Put them all on the same vlan with a random number. ISP device goes into port 1. Port 2 -> WAN1 on your MX. Port 3 -> WAN on your vendor's device. 

Set port 8 to whatever your management vlan is, and connect it back into your LAN for mgmt purposes.

[Clesher]

How aboutthe failover setup? 

[Clesher]

I want to try this set up. But how about my failover? 

[timeshimanshu]

@Clesher  can you ask some more details from your client. i believe your client is asking your public IP to whitelist at there end to allow you to use some of there application which is not publicly available.

[Clesher]

Our client who are leasing on our office has separate network and decided to use our internet. So they have their own router and switch. They are asking for a Public Ip routed from Meraki to their router not going to a NAT process because they are having issue with the UDP port and they don't want to bother us everytime there is some changes they will make because that means we also have to change config also. 

[Uberseehandel]

We put a third party security appliance aka Kharon in front of our MX.  Kharon has two LAN ports, the MX is attached to LAN2 and passes through to the Internet. NAT-ing may be disabled on Kharon.

I have no issues with connecting from the MX environment to the Internet. I can do some tricksy stuff too, eg Kharon has a Pseudo-Ethernet port defined on its WAN port. This allows access to the Web interface of the VDSL (FTTC) of the modem, even from a phone that is WiFi connected to my Z3C, which is wired to the MX, which I haven't worked out how to do in an exclusively Meraki environment (in this context Pseudo Ethernet is analagous to having a virtual switch on the WAN uplink with multiple peth switch ports.

I mention this because the cost of Kharon is nether here nor there, and it allows me to sort the sheep from the goats, as far as network security is concerned.

This isn't a marketing exercise, it was the most cost effective solution to several problems, and provided some capabilities we did not have previously. I am able to run M2M Meraki VLANs through it transparently.

[Clesher]

Just to give an update. I have done all of your advice.Our main ISP is now working on both Meraki and client. I just have concern with my failover. 

Original set-up :  ISP->Meraki->Client

New setup       : ISP-> L3 Switch -> Meraki and Client.

On the original set-up,my failover is connected to WAN2 port of Meraki. Please note that my failover is working perfectly with Meraki. When main ISP(WAN1) is down, WAN2 will take over until WAN1 is up again.

On the new set-up, I configured a Layer 3 switch and connect both the client and Meraki in there.

 So now, instead of my WAN2(failover) directly connected to Meraki port. 

I connected WAN2 to our Layer 3 switch first. Then from L3 I connected it again to WAN2 port of Meraki. I tried to unplug WAN1 from Meraki, WAN2 take over as usual  but when I put back WAN1 and perform traceroute I notice that it is still the WAN2 on the route. It should be WAN1 again.  What should I configure in Meraki? 

Please also note that the L3 switch does not have the capability to do failover that is why I am counting on Meraki and client to configure the failover.