Linking 2 MX84s directly without VPN

[FTI-nsutterby]

It is a fairly simple setup, we need all sites (except 2 subnets) to pass VPN traffic between each other.  The other 2 main offices have a wireless point-to-point link connecting them and they are not members of VPN tunnels between themselves, yet are members of VPN tunnels to all other offices.

Port 1 (physical interface) on our existing firewall of subnet 192.168.1.0/24 has a static IP assigned of 192.168.15.250

Static route is assigned that says destination is 192.168.15.0/24 use port 1 of gateway appliance 192.168.1.11

On the other side, subnet 192.168.15.0/24 we have a static route set that says destination 192.168.1.0/24 next hop is 192.168.15.250

This has been working for years using a combination of Fortigate 100D and/or Zyxel USG210 appliances along with our prior Cisco SA540 devices.  Meraki support has not been able to assist in recreating this setup with their devices.

[PhilipDAth]

Where to start.

I'm assuming the site on the end of the point to point link has no other separate Internet - is this correct?

Does this remote site even need an MX?  Could you not just use the main MX and configure a VLAN and plug the WiFi circuit into that, and use the main MX for dong all the routing?

If the remote site really does need separate layer 3 routing and has no other Internet access then the MX is not really the best solution.  Depending on the number of ports needed, I'd use a L3 switch like an MS210.  Then you can have simple L3 routing.  It will look something like:

https://documentation.meraki.com/MR/WiFi_Basics_and_Best_Practices/Extending_the_LAN_with_a_Wireless... 

Otherwise, if there is some other need to have an MX on the remote site, you need to make a larger change.  Make the WiFi link itself the Internet circuit.  For example, run the WiFi link directly into the ISP router.  Then plug the WAN port of each MX into this same subnet.

Now the MX's will build a VPN between themselves just like all the other MXs and life will be simple.

[FTI-nsutterby]

Both sites have their own respective ISPs connected to the existing firewall/UTM appliances.  The reason that we have a FCC licensed wireless PTP link rather than a VPN connection is due to bandwidth requirements.  Our existing infrastructure allows a 400Mbps connection between the 2 buildings without any additionally imposed loss to bandwidth as we don't need any security policies to filter or scan between the 2 buildings as packets pass.  The buildings have direct connections for SQL database queries for our TMS software applications, along with hourly replication schedules for our server DR environment, which cannot be done with a VPN tunnel easily without packet loss, etc.

The 2 buildings are on different subnets as well, as our primary HQ location has pretty much saturated all available IP addresses on the existing class C network as well, which is why we did not extend the exiting network to the other building.  I guess a VLAN could be setup and use the ISP at primary HQ site for web traffic, just not the way it was intended to run, especially as we have transitioned into a whole company VOIP system, so concerns would be adding all the extra nodes running traffic over the wireless link and then out to the ISP from the corporate HQ site.

Appreciate all the community help and advice here!

[PhilipDAth]

In that case that makes it simple.

On each MX configure a VLAN in the same subnet, assign it to an access port, and plug the WiFi link into it.  Then create a static route pointing to the remote site with he remote subnet(s).

[PhilipDAth]

Basically you want to follow this guide, but you don't need to configure the failover VPN.  The MPLS circuit in the document would be your WiFi link.

https://documentation.meraki.com/MX/Deployment_Guides/MPLS_Failover_to_Meraki_Auto_VPN 

[FTI-nsutterby]

Philip, this "faux MPLS" setup looks like it might just be the right solution, kudos sir!

[FTI-nsutterby]

That sounds feasible, the problem we have had so far is that when trying to setup a static route with the devices, while also being members of the VPN mesh network, the system argues about subnet overlaps and will not save changes.  We have spent quite a bit of time with Meraki tech support on the phone and emails back and forth, including network topology maps, yet have not been provided a solution as simple as you are recommending, but I will give it a shot and see how it works.  I agree with you, it really should be much simpler than it has turned out to be.  I have never had problems setting this up with all prior devices over the last 10 years - LOL!

[PhilipDAth]

You should get a warning about a subnet overlap, but it should still let you save the config.  In your case, the subnet overlap is on purpose.

[FTI-nsutterby]

Hey Philip, one more thing.  In our existing Fortigate (which I'm more used to)  config, I can set an IP on the port the wireless link is connected to, on the Meraki it isn't the same.  I want to make sure I understand how Meraki is doing the "next hop" for routing in the table. Since the wireless link itself is basically transparent (meaning the only IP address is for management) once you plug it into both devices at each end, it acts as one long wireless network cable.  I'm sure this is super easy, but don't want to miss a step. In our existing device we can bind a route to an interface/port.

If I replicate the MPLS with auto-vpn failover, would I set the following route?

MX84-Corporate is 192.168.1.11 and MX84-Kercher is 192.168.15.1

On MX84-Corporate add static route that says subnet 192.168.15.0/24 next hop = 192.168.1.XX?  I'm not sure how to give it a next hop to be honest since there is no IP associated with the link.  Would it be easier to create a VLAN for a port on each MX84 and use that for the routing? We have MS225-48LP's at corporate but not at the other site.

[FTI-nsutterby]

Is anyone else monitoring this thread?