MPLS through internet port on MX67

[nikmagashi]

Hi,

We have an mpls line from HQ to a branch office. We had on both sites fortigates and worked good. On the branch office we replaced the fortigate with a MX67 and now we are having problems with the traffic that comes from the HQ to the branch office. The mpls line terminates in internet port in the MX67. So all the trafic from the MX is sent through the mpls to the HQ firewall. We can ping the networks on the HQ from the MX67 internal vlans, but doing it from the HQ to the branch offices MX the ping never respond back. I know it might have something with the NAT on the internet port on the MX but I need to be sure if someone has had the same issue. 

When I look at the route table I see a default route 0.0.0.0/0 through the wan interface. It worth mentioning that I have not created any static route on the MX!

BR 

[alemabrahao]

Have you checked this document?

https://documentation.meraki.com/MX/Networks_and_Routing/Integrating_an_MPLS_Connection_on_the_MX_LA...

[cmr]

Put the HQ MX in single ended concentrator mode and connect the MPLS via a L3 switch at HQ.  On the L3 switch have a default gateway to enterprise edge firewalls.

Works well unless you are trying to use the same MX to terminate MPLS and internet at HQ...

[nikmagashi]

We have a fortigate on the HQ and MX67 on the branch office. I called today meraki support and they helped me with this problem. They activated the NAT feature where I could later choose to disable the NAT on the internet port on meraki or even on the specific vlan if I want to. Of course this should be taken with precaution since the inbound rules are in allow state now but we do have a firewall on the HQ which controll everything.