Failover for non Meraki vpn peer

carlto
Just browsing

Failover for non Meraki vpn peer

Hi All

Is it possible in Meraki to add a second peer for a site to site vpn for failover? we have a meraki firewall and the other end is an ASA with 2 public ip addresses, if the primary link on the ASA fails we want the Meraki to fail over to the ASAs second public IP, is this possible?

Cheers

4 Replies 4
MartinLL
Building a reputation

if you plan on doing it without BGP you would need to do something like this.

Tag-Based IPsec VPN Failover - Cisco Meraki Documentation

 

When you configure two static tunnels towards the same network segment the traffic will flow across both tunnels at random i think.

 

A better solution would be to do site to site with BGP peering. It's available from MX19.1 and up, so quite fresh. But it could be worth looking into.

MLL
carlto
Just browsing

The Tag based one looks a little overkill and complex for a simple task, the BGP idea might be better, would this be using VTI tunnels then ?

MartinLL
Building a reputation

How exactly how Meraki handles tunnels is unknown to me sadly. But i read somewhere that the MX only does policy based VPN.

MLL
GIdenJoe
Kind of a big deal
Kind of a big deal

As of now the tunnels are policy-based VPN tunnels, so no VTI.

Tag based failover is the only way for the moment.

Get notified when there are additional replies to this discussion.
Welcome to the Meraki Community!
To start contributing, simply sign in with your Cisco account. If you don't yet have a Cisco account, you can sign up.
Labels