Failover for non Meraki vpn peer

[carlto]

Hi All

Is it possible in Meraki to add a second peer for a site to site vpn for failover? we have a meraki firewall and the other end is an ASA with 2 public ip addresses, if the primary link on the ASA fails we want the Meraki to fail over to the ASAs second public IP, is this possible?

Cheers

[MartinLL]

if you plan on doing it without BGP you would need to do something like this.

Tag-Based IPsec VPN Failover - Cisco Meraki Documentation

When you configure two static tunnels towards the same network segment the traffic will flow across both tunnels at random i think.

A better solution would be to do site to site with BGP peering. It's available from MX19.1 and up, so quite fresh. But it could be worth looking into.

[carlto]

The Tag based one looks a little overkill and complex for a simple task, the BGP idea might be better, would this be using VTI tunnels then ?

[MartinLL]

How exactly how Meraki handles tunnels is unknown to me sadly. But i read somewhere that the MX only does policy based VPN.

[GIdenJoe]

As of now the tunnels are policy-based VPN tunnels, so no VTI.

Tag based failover is the only way for the moment.

[IvanJukic]

Hi @carlto ,

This might interest you 😉

"BGP peering over IPsec VPN tunnels can be enabled on the Meraki Security Appliance. This unlocks new dynamic routing use cases for customers in addition to enabling resiliency and redundancy over IPsec VPN peers. "

https://documentation.meraki.com/MX/Site-to-site_VPN/BGP_routing_over_IPsec_VPN