Is it a supported configuration to have multiple MX appliances behind a single NAT device with Auto VPN? I have two MXs in a lab environment and it works fine. I am trying to do a quick patch for a customer issue until they get proper links. I don't think the vpn registry should have an issue because each MX would use a different source port even if the public IP is the same.
Solved! Go to solution.
Yes, if I understand what you described this is supported and should work fine. I have that type of setup in my own home lab with multiple MX appliances behind he same NAT and all AutoVPN'd together. The VPN Reg and devices themselves are fully aware of both public and interface addresses and src/dst ports and the tunnels should form without issue.
Yes, if I understand what you described this is supported and should work fine. I have that type of setup in my own home lab with multiple MX appliances behind he same NAT and all AutoVPN'd together. The VPN Reg and devices themselves are fully aware of both public and interface addresses and src/dst ports and the tunnels should form without issue.
Thanks MeakiDave, just wanted to confirm.
Hi,
Is this true also when the two internal MX appliances are in different subnets?
I assume in either case there is hairpin NAT necessary on the internet gateway router.
Kind regards,
Frank
Source: https://meraki.cisco.com/blog/2018/06/all-about-autovpn/:
The punch process
The punch process is actually the “client” in a client-server relationship, with the server portion being the “Cisco Meraki VPN Registry.” The VPN Registry is a service independent of the Meraki dashboard, used to register each MX’s public and interface IP addresses. The Registry then uses some simple logic to understand how to route between the various MXs in an organization (in order to create VPN tunnels). Namely:
The VPN registry then passes this information to the dashboard.
I guess I just found the answer:
"If the two MX’s public IP addresses match, then the MXs in question are in the same private network. As such, they should route to one another via their interface IP addresses"
Yes, we do this a lot, we have about twenty MXs that all appear as the same public IP and the SDWAN connections form between the private WAN IP addresses.