Meraki to Non Meraki VPN with ATT Buisness Fiber

[igarza]

Just wanted to throw this out there in case anyone else is having similar issues. We have 50+ branch offices all with different ISP combinations but the with Meraki Firewalls that are connecting to ATT Business Fiber Modems that s2s to Fortigates and various other devices, it is a reoccurring problem for tunnels to remain "up" but traffic is unable to pass from one LAN to another and this occurs at random times. Meraki to Meraki is fine but for whatever reason, I believe those ATT modems are conflicting with the handshake between Meraki and non Meraki devices. I solved the issue by forcing non Meraki traffic to use the non ATT WAN but have not been able to find out what is going on with the ARIS modem that is causing the problem and have verified the modems to not have any type of firewall or nat enabled. Just want to make it clear that the ATT is straight pass through. No Nat and no firewall. Public IP addresses are directly on the MX.

[PhilipDAth]

Do you have the public IP addresses directly on the MX units?  If no, try and make it this way (much more reliable).

If you have to run the MX through NAT check the UDP timeout behaviour of the NATing router.  If it times out too quickly it will break VPNs.  A lot of consumer grade routers don't allow you to configure the NAT translation timeouts.

[OHTorx]

As @PhilipDAth eluded to, if you are forced to be behind ATT device's NAT you will need to ensure that NAT-T is enabled on your third party VPN tunnel on both sides. Meraki support can confirm this from their dashboard.