IPsec Tunnel Not Establishing

[athan1234]

've spent two weekends trying to resolve this issue, so I want to give you some context.

The goal is to establish an IPsec tunnel between two Meraki devices.

One Meraki is located at our headquarters, and the other is at a client's site. The purpose of this tunnel is for monitoring.

The issue seems to be on the infrastructure at our HQ. There are two FortiGate firewalls—one handling LAN traffic and the other WAN. The WAN firewall uses VDOMs and has multiple NATs configured. I suspect the IPsec VPN isn't coming up due to something related to the provider's router—maybe it's not operating in transparent mode?

Any ideas? Meraki’s event logs don’t show any helpful troubleshooting information.

[DarrenOC]

What are your wireshark logs showing you?  Do you see traffic at either end being blocked/dropped?

[athan1234]

If I do the packet capture on the customer side, I don't get anything

[DarrenOC]

Have you sniffed on the WAN port rather than the vpn?  The tunnel needs to establish first.

[athan1234]

where in my custumer side or my side 

[ChrisJ2]

Hi, 

Assuming the MXs are in different dashboard Organizations, then this would be treated as a non-Meraki VPN.

I would suggest a packet capture on the Primary WAN (Internet) interface on both sides, filtering for the public IP of each remote appliance:

(so, from your site, x.x.x.x would be the Public IP of your Customer's MX and vice-versa)

Then you will be able to verify if ISAKMP traffic is being sent from /reaching either side.

If there is another firewall upstream, ensure UDP 500 and 4500 is allowed to and from the remote side.

If you are using IKEV2, please understand these settings, especially the local and remote ID fields, if either side is behind NAT.

The event log can also be a useful source of information.

If you need further assistance, please do not hesitate to open a Support case, we are here to help! 😊

[athan1234]

Hi, thanks for your reply. I did the packet capture on both sides - the host with public IP and the other side - and I did not have any traffic

[alemabrahao]

Well, if nothing is getting to Meraki, it means that traffic is not even leaving the FortiGate, in this case, ensure that the NAT configuration on the FortiGate that handles WAN traffic is correctly configured to allow IPsec traffic. This includes ensuring that UDP ports 500 and 4500 are open and forwarded correctly.

I would start by troubleshooting the Fortigate side to make sure the traffic is being routed correctly.

[athan1234]

So what is your idea, how can I do it? The VPN is a tunnel and first I should establish the IPsec tunnel on the Meraki, or maybe I am wrong and I must check the FortiGate. Any idea for doing it? If on the customer side, they do a tracert or ping against public IP on the other side, the FortiGate receives the reply, but I can't see any traffic on port 4500 and 500 UDP. On the other hand, I can see traffic for other public IPs, but I can't see it for that specific IP

[athan1234]

any idea?

[ChrisJ2]

You will need to send "interesting traffic" (ie: a continuous ping) from a device behind the MX in one of the exported subnets, toward a device in a subnet behind the remote peer that is participating in the VPN to bring up the tunnel.  You should then at least see ISAKMP initiator requests egressing the MX WAN interface. you can verify with a capture on the internet interface of the MX. These would be UDP packets toward the remote peer public IP on port 500 or 4500. If you are using a PPPoE uplink, the filtered capture would be blank unless you filter for "pppoes and host x.x.x.x"

[athan1234]

Hi again,

Is it possible to configure the Meraki in "like indicator" mode? I would like to perform the initial setup with a FortiGate device. However, I can't find the "Non-Meraki peer" option—only the IPSec VPN option is visible.

My concern is that the Meraki device receives a private IP address on its WAN interface, and I suspect there might be an issue on the provider's side with UDP port 500. It's quite difficult to contact the provider to either set the router to bridge mode or to forward port 500 to the private IP.

Current setup:

• Public IP: 81.x.x.x.x

• Hostname: 56.red-81--tde.net

• WAN 1 Settings:

  • Type: IPv4 Dynamic

  • Status: Active

  • IP Address: 192.168.1.37

  • Gateway: 192.168.1.1

  • DNS: 80.x.x.x, 80.x.x.x

  • IPv6: Auto (Stateless), Not Active

Given this, I’d like to know if I can configure the FortiGate with a dynamic  and specify a set local ID, and still get the VPN tunnel to work.

[alemabrahao]

Hello

Unfortunately, it is not possible, when in doubt about Fortigate it would be interesting to check with their community.

[athan1234]

Okay, but could you confirm if it is possible to change the setup in Meraki so that the router is in NAT mode? Also, how can I know if the Meraki router is blocking UDP port 500 for the IPsec tunnel

[alemabrahao]

Meraki devices do not have a "like indicator" mode, but you can set up a non-Meraki VPN peer.

To find out if Meraki is blocking you can check the Meraki logs, or even check if there is a rule that is configured to block port 500, which I personally find difficult since Meraki by default allows everything, unless you have explicitly created a rule.

https://documentation.meraki.com/MX/Site-to-site_VPN/Site-to-Site_VPN_Settings#Non-Meraki_VPN_Peers

[athan1234]

yes, I know that Meraki allows all traffic. The problem is that the provider's router is not in bridge mode. If you look, the communication goes through a private IP (the default gateway router). It's possible that the provider doesn't have port forwarding configured and is not allowing . . 

[alemabrahao · Accepted solution]

I understand, in this case the only option I see would be to check with the ISP.

[athan1234]

was solved the problem was in the provaider