Meraki Cloud Connectivity & MX site to site tunnels

[FlyingFrames]

If Meraki cloud connectivity goes down, not due to the internet but some other cloud issue.

Will the site to site tunnels still stay up forever?

Or will they timeout after sometime and request Meraki cloud reachability to re-key them selves?

It says the below in the doc:

https://documentation.meraki.com/MX/Site-to-site_VPN/Meraki_Auto_VPN_-_Configuration_and_Troubleshoo...

"Once the information is shared with the MX about its peers, a VPN tunnel is formed MX to MX. The Meraki cloud already knows the subnet information for each MX, and now the IP addresses to use for tunnel creation. The cloud pushes a key to the MXs in their configuration which is used to establish an AES encrypted IPsec-like tunnel."

Hence its not clear from the documentation!

[alemabrahao]

@FlyingFrames  Usually when there is a problem on the dashboard they send an email informing about the problem and also informing us not to worry that the client's network will continue to work normally.

But I'm not sure if there is documentation with this information.

[JJ22]

Today, we have begun seeing issues with some of our networks not connecting to the cloud server. The users get the normal splash page but once they hit connect they get an error message saying that they cant connect to the server. This started out of the blue today. 

[alemabrahao]

What are the MXes model and version? 

Security appliance firmware versions MX 16.16.1 changelog
Important notice

While Meraki appliances have traditionally relied on UDP port 7351 for cloud communication and TCP ports 80 and 443 for backup communications, with MX 16 we are beginning a transition to using TCP port 443 as the primary means for cloud connectivity. In order to ensure proper connectivity to the Meraki cloud after this upgrade, please ensure that traffic using TCP port 443 between 209.206.48.0/20 is allowed through any firewalls that may be deployed upstream of your Meraki appliances.
HTTP proxy, which allows default management traffic from MX appliances to be sent through a proxy, is deprecated on MX 16 and higher firmware versions.

[alemabrahao]

Check this post:

https://community.meraki.com/t5/Meraki-Service-Notices/Dashboard-issues-affecting-device-status-and-...

[Brash · Accepted solution]

The same document also says the following

"Expected behavior. If the MX losses connectivity to the VPN registry, peer information gets purged over time but not immediately. Connectivity to the registry matters when a node changes its contact information after losing connectivity to the VPN registry.

Both the hub and spoke will still be able to form the tunnel if the contact information remains the same, and they lost registry connectivity. Peer information will purge after a few hours causing the tunnel to be marked down."

It sounds like there is a timeout where the peer info gets purged and connectivity to the VPN registry is required for the tunnel to remain established. That said, I've never seen this occur. 

For the exact length of time the tunnels remain up for, you'd probably need to ask Meraki support.