New S2S VPN between my Meraki Firewall and Azure

[charlesfors]

Hello:

We are planning to do the setup of a new S2S VPN between our end (firewall MX84) and Azure

First I would like to explain to you the configuration that we want to implement on our end

1-Our firewall has two lines connected to the internet.

2-Currently, the principal line (Verizon) is UP and it is using a "Site to Site" VPN between our end and Azure cloud that allows the connection between our private network and Azure

3-Now we want to activate the Comcast line as a failover line, so in case the Verizon line goes down, Comcast line goes UP automatically and keep the "Site to Site" VPN connection working without interruption

My question is:
1-Do I have to configure BGP protocol (in our firewall and Azure end) to achieve the failover?

Thank you, Charles

[alemabrahao]

Maybe it will help you.

 https://community.meraki.com/t5/Security-SD-WAN/Meraki-MX-250-HA-pair-and-Azure-VPN-Gateways-IPSEC-f...

[alemabrahao]

Is the vMX on Azure one option?

I think it's more simple.

[PhilipDAth]

Using Azure, you might as well say the answer is no, because what you have to do to make it work is beyond most people.

If you value failover, buy a VMX-S.

https://meraki.cisco.com/product/security-sd-wan/virtual-appliances/vmx-small/ 

[GreenMan]

What @PhilipDAth said...    you likely will not get this working how you would desire using non-Meraki VPN.   If you purchase VMX (particularly if you purchase two, for resilience) it will be miles simpler, more resilient and provide you policy and performance routing too.

https://documentation.meraki.com/MX/MX_Installation_Guides/vMX_Setup_Guide_for_Microsoft_Azure 

https://documentation.meraki.com/MX/Deployment_Guides/vMX_and_Azure_Route_Server

https://documentation.meraki.com/MX/Networks_and_Routing/Border_Gateway_Protocol_(BGP)

https://documentation.meraki.com/MX/Firewall_and_Traffic_Shaping/SD-WAN_and_Traffic_Shaping

[jimmyt234]

Configure your Azure connection to the Dynamic DNS hostname of the MX, this will auto-failover, albeit rather slowly.

The real, elegant solution is to deploy a vMX in Azure.