Non-Meraki IPSEC Tunnel configuration

[AjitKumar]

Hi Friends,

Is the following configuration possible on MX100 (IPSec)

The Customer is going to connect to their client's network (The client's network might have ASA / Fortigate).

Question 1

• From Branch-1 to Client-1 Site-to-Site VPN (IKEv1) on Primary ISP
• From Branch-1 to Client-1 Site-to-Site VPN (IKEv1) on Secondary ISP
• From Branch-1 to Client-2 Site-to-Site VPN (IKEv1) on Primary ISP
• From Branch-1 to Client-2 Site-to-Site VPN (IKEv1) on Secondary ISP
• From Branch-1 to Client-3 Site-to-Site VPN (IKEv2) on Primary ISP
• From Branch-1 to Client-3 Site-to-Site VPN (IKEv2) on Secondary ISP
• From Branch-1 to Client-4 Site-to-Site VPN (IKEv2) on Primary ISP
• From Branch-1 to Client-4 Site-to-Site VPN (IKEv2) on Secondary ISP

Question 2

Also please confirm NAT (Network Address Translation) is possible over Site-to-Site VPN Phase2 as interesting traffic?

Question 3

SSL based remote access VPN is possible? If yes, please confirm the SSL VPN traffic can be rerouted to existing Site-to-Site VPN of Branch-1 clients

Example:

• End User-1 connect branch-1 SSL VPN and access Client-1 Site-to-Site VPN (IKEv1)
• End User-2 connect branch-1 SSL VPN and access Client-3 Site-to-Site VPN (IKEv2)

Regards Ajit

[Sushil]

Answer 1 

 IKEv2 is supported 15.12 onwards. Non Meraki VPN tunnels are established using the Primary WAN Interface. It will failover and establish using WAN2. You need to make sure that the VPN Peer has WAN2 IP configured.

Answer 2 

 Its not supported for Non-Meraki VPN tunnels. AutoVPN tunnels have NAT available.

https://documentation.meraki.com/MX/Site-to-site_VPN/Using_Site-to-site_VPN_Translation

Answer 3

SSL VPN is not supported yet