Anyone know if the 2 are compatible for IKEv2?
According the Meraki
Meraki Appliances build IPsec tunnels by sending out a request with a single traffic selector that contains all of the expected local and remote subnets. Certain vendors may not support allowing more than one local and remote selector in a given IPsec tunnel
Trying to figure out if Fortigate is one of the vendors that doesn't support multiple selectors.
Solved! Go to solution.
Hi All,
i appreciate everyone's input.
My question was in regards specifically to MX IKEv2 with a Fortigate firewall.
At its most basic config, the tunnel would not come up.
I did find that it is a compatible configuration, however there was a gotcha... Even though it was a direct connect to internet, on both sides, no NAT devices, absolutely nothing in the middle, it wasn't until after configuring the local and remote IDs, the tunnel came up.
@mmistretta : yes they are
https://community.meraki.com/t5/Security-SD-WAN/Meraki-MX-to-Fortigate-IPSEC/td-p/47665
Thank you for the reply, but the question is in regards to IKEv2.
Unless i missed it, i do not see mention of IKEv2 in the article.
@mmistretta : Yes IPsec using IKEv2 and there is IKEv2 support for 3rd Party VPN on 15.12+ onwards and this is enabled via Meraki support
https://community.meraki.com/t5/Security-SD-WAN/IKEv2-support-on-MX-devices/td-p/37709
Hello,
That information you cited is out of date - IKEv2 is now freely selectable on the site-to-site VPN page without Support involvement
That's a tough one to answer. If you're able to test it, I would.
I know a Cisco ASA does not support multiple TS with IKEv2.
So there is always chance that the Fortigate might also have a different way of doing it.
I would prefer if Meraki would make VTI- routed based VPN available.
@GIdenJoe wrote:I know a Cisco ASA does not support multiple TS with IKEv2.
There has to be a different reason if that didn't work somewhere. The ASA supports this and I use it with lots of customers.
Hi All,
i appreciate everyone's input.
My question was in regards specifically to MX IKEv2 with a Fortigate firewall.
At its most basic config, the tunnel would not come up.
I did find that it is a compatible configuration, however there was a gotcha... Even though it was a direct connect to internet, on both sides, no NAT devices, absolutely nothing in the middle, it wasn't until after configuring the local and remote IDs, the tunnel came up.
@mmistretta wrote:[...] it wasn't until after configuring the local and remote IDs, the tunnel came up.
Which is also a change in behaviour for MX15.42.1 firmware.
From release notes;