Failover for non Meraki vpn peer

[carlto]

Hi All

Is it possible in Meraki to add a second peer for a site to site vpn for failover? we have a meraki firewall and the other end is an ASA with 2 public ip addresses, if the primary link on the ASA fails we want the Meraki to fail over to the ASAs second public IP, is this possible?

Cheers

[MartinLL]

if you plan on doing it without BGP you would need to do something like this.

Tag-Based IPsec VPN Failover - Cisco Meraki Documentation

When you configure two static tunnels towards the same network segment the traffic will flow across both tunnels at random i think.

A better solution would be to do site to site with BGP peering. It's available from MX19.1 and up, so quite fresh. But it could be worth looking into.

[carlto]

The Tag based one looks a little overkill and complex for a simple task, the BGP idea might be better, would this be using VTI tunnels then ?

[MartinLL]

How exactly how Meraki handles tunnels is unknown to me sadly. But i read somewhere that the MX only does policy based VPN.

[GIdenJoe]

As of now the tunnels are policy-based VPN tunnels, so no VTI.

Tag based failover is the only way for the moment.