Meraki VPN Client on cellular

[Antonionjeim]

Hello Merakis!

I am new to Meraki, I will be posting for some help here.

i am not able to connect to mx68cw client VPN, I did the step-by-step guide from the Meraki website, but nothing works,I contacted the support, they cannot capture any data using packet tracing.

anyone can help?

Thanks 

[PhilipDAth]

Are you getting to connect to a fixed line broadband or a celluar connection on the MX? 

What happens when it didn't look?   Do you get to enter a username and password?   Do you get any error message? 

[Antonionjeim]

Thanks for your quick reply, 

it's running of 4G as the only uplink, and it's using the integrated sim slot in the Meraki MX68CW.

The steps that I did: (i am using MacOS)

1- enable Client-VPN on the dashboard
2- 

3- Create the VPN following up the Step-to-step instructions for mac on the Meraki website.

4- that what I get when I try to connect:


Keep in mind that on the Appliance status > uplink  the public IP is different the ip on the cellular.

[PhilipDAth]

Tihs is almost certainly an issue with your cellular carrier filtering inboud traffic to you.

With any luck you carrier will offer an APN where they do not do this.  If you Google the name of your carrier and terms like "L2TP" or "VPN" and "APN" you might be able to find this.

Once you have an APN you can use you'll need to open a support case and ask them to configure the MX68 to use that APN.

[Antonionjeim]

You are a legend with your quick reply any both topics I posted so far!! 



as far as I know, that was already done, the APN was already changed by default, I didn't even have to change it manually.

am i missing something still ?

[GeoffG]

Hi people

Just wondering if there was a resolution for this ?

Do Meraki have to do something on the backend to get the APN to be recognised.

I have a Telstra mobile SIM that I have been advised has been configured to be used on the telstra.extranet APN and I have added the APN name to the Uplink page as shown in image as well.

no luck for me though....

[OVERKILL]

Just use AnyConnect. 

I ran into a similar issue recently (cell wouldn't work, but it worked fine with a laptop) so I just had him download the AnyConnect client and it worked perfectly right out of the gate. 

[GeoffG]

Hi mate thanks for response.  

Just to clarify though, AnyConnect I presume is still going to require inbound 443 connections to the Meraki MX which from my understanding is an issue for this scenario as it is using a 4G Cellular only connection.  Is that correct? 

I'm not sure if there is something additional required to enable a specific APN(telstra.extranet) in the Meraki MX to enable it connect to this specific APN and then see these inbound connections. 

I think by default, on the ISP side(Telstra), they filter inbound connections on udp/500, udp/4500 or even tcp/443 for standard 4G services.

Philip earlier in this thread has mention Meraki May have to do something to enable a different APN on the MX...  "Once you have an APN you can use you'll need to open a support case and ask them to configure the MX68 to use that APN."

Cheers

[OVERKILL]

If they are blocking 443, you can put it on another port, it's configurable. I'd give it a shot, it's more apt to work than L2TP. 

[Make_IT_Simple]

I bet you that your cellular service is either double NATting your public IP or blocking/overwriting port 500/4500. To confirm this, run a pcap from the MX internet port while you are trying to connect. either you won't see anything or the device is using something different than 500/400. based on the result, you will be able to set a fix for it. OR, you can always use Anyconnect which should be easier to work with compared to L2TP.

[OVERKILL]

Good point on the NAT, I can see a 10.10---- in his screenshot where he edited out the cellular IP address. 

[Make_IT_Simple]

Yes, sometimes cell service can be really wild. I had an MX using cell service that was double Natting + changing the public IP randomly (about 2-3 per day). You may check with the cell provider if they have something that can do port forwarding or something similar. It would be great, but I am not sure if it is possible. 

[GeoffG]

Yes I think this is the case also.  I have done caps and yes I came to this conclusion and that's what lead me to this forum thread.  The image shared by the other forum user is very similar to what I see in the Uplink status page on Dashboard. WAN Interface has public IP and Cellular Interface has 10.x.x.x IP.  My conclusion is CGNAT is in use and likely filtering inbound traffic.

This is why I arranged to move the 4G SIM to the telstra.extranet APN.  I updated editable section for APN(is this just a tag?) to be telstra.extranet but as I mentioned earlier, is there something else that need to be done by Meraki to make the MX connect to this alternate APN ??

Cheers guys for you responses

 

[OVERKILL]

Based on one of the earlier posts, it sounds like yes, there needs to be a config change by support so that it actually uses that APN in practice. 

[Make_IT_Simple]

You will have to work with your carrier to see if they have a solution to bypass the GC-NAT and let the MX obtain its own public IP. Or, if they can do manual port-forward, to send all the traffic for UDP port 500/4500 to the MX.

[OVERKILL]

Looks like he will have to contact Telstra and have them add a data code to his SIM, as I found this:

 

[GeoffG]

yeah thanks  

I will go back to them and see if they have done this...

Thanks for the help

[OVERKILL]

You are quite welcome! 

[harmankardon]

For anyone on a MX67C/MX68C running into issues with integrated cellular and custom APN's, try upgrading to MX 17.6 firmware. I was running into lots of issues with the integrated cellular on older firmware: some devices I could not set a custom APN myself (had to be set on the backend by Meraki support), and none of my devices would seem to take the public static IP APN from our cellular carrier (would never get the assigned public IP, always got a CGNAT IP).

After upgrading to MX 17.6, all of these issues went away. My understanding is that the cellular portion of the MX 17.x firmware is now the same as what is used in the MG line of products. In addition, there are a number of undocumented improvements in MX 17.x like: 

• Eliminated that the flood of "events dropped" that appear in the event log on devices with integrated cellular modems even if the modem was disabled and there was no SIM installed.
• New Cellular Status tab on local status page.
• Ability to set APN from local status page.
• Ability to set APN username and password from local status page.
• Ability to set cellular IP type from local status page.

If you aren't having any luck between Meraki support and your cellular provider, give MX 17.6 a shot.

[VarunBhati]

Even I am also facing the same issue, Earlier they are getting the private IP on Wan port then I request them to change it to Telstra. extranet with code and they do it after that, MX received public IP on the wan port but still my site-to-site VPN is showing down, now I am chasing with isp let see what they suggest to us, but I think isp is blocking some udp ports.

[amabt]

Posting this for anyone else having this issue and is using Telstra (Australia) and searching this issue in the future.

We have hundreds of sites with backup connection via Telstra 4G Data SIM. Provided you are on the telstra.extranet APN. Things will work no issues because you get a proper public WAN IP. You need to ensure the Meraki is set to use the telstra.extranet APN.

How to get telstra.extranet APN? You need to be on an enterprise or corp level account with Telstra and ask for telstra.extranet to be enabled on the service (magic code GPTEXB3 needs to be added to the service). Telstra by default will put you on a 10.x ip range as they don't give out a pulic WAN IP for  just any customer.

If you are a Telstra retail customer. You will get CGNAT and you will have issues.