MX to 3rd party firewall VPN

[leigh161]

Hi, I have a client that has configured a site to site VPN between a MX 95 and some 3rd party firewall. Everything is working from site to site EXCEPT the sync between a pair of Microsoft AD servers, one at each site. 

Nothing apart from the VPN authentication settings has changed on the remote site. On the Meraki side the MX device "seems" to , by default have everything open and you add rules to close stuff out. Any idea as to why then, the ports for AD are not getting across??

Thanks a million,

L 

[alemabrahao]

Meraki has implemented some security features, take a look at the article below.

https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Meraki_Device_to_Clou...

[alemabrahao]

Is the communication between the servers working? ICMP for example.

[leigh161]

Hi there,

 Thanks for the reply, yes it is - i got them to ping from one to the other using the server IP as source and it worked fine. Just issues with AD not syncing

L

[alemabrahao]

If you don't have any blocking rules in MX my only suggestion is to check if the other side may have any blocking rules.

Otherwise, I suggest opening a case with support.

[KarstenI]

You are right that by default all inbound traffic is allowed (which is the largest drawback of Meraki in my mind. If you want to make sure that your business-partners can't access just everything, you need a different device which is typically an additional ASA in my case).

You don't say anything about your setup so this is only a wild guess, but it is very often overlooked:

You are using IKEv2 and you have multiple subnets configured. The first established subnets work, but your AD controller is on the additional subnet which is not working. This would be an additional drawback of the Meraki MX as this is quite often incompatible to other vendors:

https://documentation.meraki.com/MX/Site-to-site_VPN/IKEv1_and_IKEv2_for_non-Meraki_VPN_Peers_Compar...