Multiple Site-to-Site VPN Tunnels Between the Same 2 Endpoints

[JHille-BearTech]

I have a Site-to-Site VPN connection between 2 endpoints. Can I duplicate this same connection with different subnets on each side?

[alemabrahao]

Why 3 distinct tunnels if the IP used to close the tunnel is the same on both sides? What changes is only the local subnet.

Sorry, but this configuration doesn't make sense in my opinion, since you can have a single tunnel.

[KarstenI]

What do you want to achieve here? Is it access control? For that you build *one* VPN-connection with three subnets local and three subnets remote.

If only a subset of subnets need to communicate with each other, you control that with the org-wide-firewall that you find on the same page. But this only works for AutoVPN. If you need to control it for extranet-VPNs, you are out of luck and either don’t control the traffic into your network or move the VPN to a different device that is more capable in terms of extranet-VPNs.

[JHille-BearTech]

Thank you for your responses. I also appreciate your opinions as well. Allow me to break this down, more.

I have a data center. In this data center, I have a server cluster. This server cluster is behind a Meraki MX that serves as the cluster's gateway to the internet and VPN concentrator for "branch" locations to access via site-to-site VPN connections.

My "branch" locations have 2 VLAN segregated subnets, one for their corporate network and another for their voice network. These VLANs are configured to not route between each other (no inter-vlan routing).

In my data center cluster, I have 2 VLAN segregated subnets; one for their corporate resources and another for their voice resources (PBX). These VLANs are configured to not route between each other (no inter-vlan routing).

I want to create 2 different tunnels. One to keep voice related traffic specific to the voice networks between sites and the other for corporate related traffic specific to corporate related networks between sites. I don't want to intermingle that traffic on 1 tunnel.

The diagram below is a bit more descriptive.

[JHille-BearTech]

the 3rd MGMT tunnel is not a requirement. It was added for visual context of more than 2 tunnels with the same site-to-site endpoints.

[alemabrahao]

This still doesn't make sense, it would be much easier and more practical to create a single tunnel and restrict it via firewall rules.

This will not bring you any benefit.

[JHille-BearTech]

Regardless of it making sense or whether there is benefit in it, is it possible.

[alemabrahao]

Yes, theoretically it is.

[PhilipDAth]

No.

Meraki will only allow you to have a single active SA with a remote VPN head end.

[JHille-BearTech]

I'm not sure I understand what you mean. Site-to-site VPN connections, inherently, don't have a head-end. Can you elaborate on what you're referring to?

[PhilipDAth]

Also Meraki does not support VRFs to keep the routing spaces seperate.

[JHille-BearTech]

Can you elaborate on this as well? VRFs, to my understanding, are related more to VLAN configurations than VPN connections. How does this apply to my request?