Meraki

MCMKA · ‎Oct 14 2022

Hello ,

I'm trying to setup IPSec S2S VPN Tunnel to non-Meraki peer . The only thing which I found in Event Log is

Non-Meraki VPN negotiation

msg: FIPS mode disabled

I tried to find solution but no success , could you advice me what I can do ?

Best regards,

Czarek

AI-generated summary

From your community moderators: We're experimenting with using AI to summarize some of our longer threads. The summary has been reviewed by humans for accuracy.

Problem

The original poster encountered a "FIPS mode disabled" message during Non-Meraki VPN negotiation, indicating their MX device was behind NAT and experiencing VPN connectivity issues with a third-party device.

Summary

The discussion revealed that the problem stemmed from incompatible IPsec encryption policies between the Meraki device and the non-Meraki endpoint. The solution involved researching Meraki's FIPS documentation and adjusting the IPsec Phase 1 and Phase 2 configurations to use weaker but compatible encryption algorithms, specifically switching to 3DES and MD5 instead of stronger modern ciphers. One community member confirmed this approach worked for their setup, though they expressed reluctance about using the less secure 3DES and MD5 algorithms. The thread suggests that resolving FIPS mode disabled errors typically requires experimenting with different Phase 1 and Phase 2 configurations until finding a compatible combination between the Meraki and non-Meraki devices.

alemabrahao · ‎Oct 14 2022

Confirm that all Phase 1, Phase 2 and PSK settings are the same on both sites.

Non-Meraki VPN peers

You can create Site-to-site VPN tunnels between a Security Appliance or a Teleworker Gateway and a Non-Meraki VPN endpoint device under the Non-Meraki VPN peers section on the Security & SD-WAN > Configure > Site-to-site VPN page. Simply click "Add a peer" and enter the following information:

A name for the remote device or VPN tunnel.
What IKE version to use (IKEv1 or IKEv2)*
The public IP address of the remote device.
The Remote ID of the remote peer. This is an optional configuration and can be configured to the remote peer’s UserFQDN (e.g. user@domain.com), FQDN (e.g. www.example.com) or IPv4 address as needed.
- Which of these values you use is dependent upon your remote device. Please consult its documentation to learn what values it is capable of specifying as its remote ID, and how to configure them (e.g. crypto isakmp identity for ASA firewalls
The subnets behind the third-party device that you wish to connect to over the VPN. 0.0.0.0/0 can also be specified to define a default route to this peer.
- Note that if an MX-Z device is configured with a default route (0.0.0.0/0) to a Non-Meraki VPN peer, traffic will not fail over to the WAN, even if the connection goes down.
The IPsec policy to use.
The preshared secret key (PSK).
Availability settings to determine which appliances in your Dashboard Organization will connect to the peer.

*IKEv2 requires firmware version 15.12 or greater

When configuring NMVPN connections between 2 MXs in different organizations that are running MX15 code and above that are not using a UserFQDN and are NATed behind an upstream device, please ensure that the remote ID field of the NMVPN peer is filled out with the private IP address of the remote NATed MX.

Non-Meraki VPN Peering with FQDN

This feature enables the use of FQDN instead of an IP address while configuring a Non-Meraki VPN peer. Using IP addresses can be tedious because with a dynamic IP address, a customer has to manually modify the Non-Meraki VPN settings on the Site-to-Site VPN page when there is an IP address change. With FQDN configuration, the hostname of the remote peer would automatically get resolved each time a connection is initiated.

“FQDN” differs from “User FQDN”. The MX resolves the FQDN to an IP address of the remote peer, whereas, “User FQDN” is used in conjunction with the IP address of the remote peer. “FQDN” identifies the remote peer and is configured in the “Public IP/Hostname” field. “User FQDN” identifies the local peer and is configured in the “Local ID” field.

Supported Products:

MX running firmware 18.1 or higher
Requires IKEv2

Configuration

The FQDN of the Non-Meraki VPN peer can be configured in the Public IP/Hostname field when IKEv2 is the selected IKE version.

The default behavior of the MX is to set remote_id to FQDN if it is not explicitly added in the dashboard "Non-Meraki VPN peers" settings. Please note, the remote id on one peer needs to match the local id on the other peer for the tunnel to be established.

If the configured FQDN fails to resolve, an event will be reported in Network-wide > Eventlog on Dashboard

NOTE For IKEv2

Meraki Appliances build IPsec tunnels by sending out a request with a single traffic selector that contains all of the expected local and remote subnets. Certain vendors may not support allowing more than one local and remote selector in a given IPsec tunnel (e.g. ASA 5500-X series firewalls running certain firmware releases); for such cases, please use IKEv1 instead.

An MX-Z device will not try to form a VPN tunnel to a non-Meraki peer if it does not have any local networks advertised.

IPsec policies

There are three preset IPsec policies available.

Default: Uses the Meraki default IPsec settings for connection to a non-Meraki device
AWS: Uses default settings for connecting to an Amazon VPC
Azure: Uses default settings for connecting to a Microsoft Azure instance

If none of these presets are appropriate, the Custom option allows you to manually configure the IPsec policy parameters. These parameters are divided into Phase 1 and Phase 2.

Phase 1

Encryption: Select between AES-128, AES-192, AES-256, and 3DES encryption
Authentication: Select MD5, SHA1 or SHA256* authentication
Diffie-Hellman group: Select between Diffie-Hellman (DH) groups 1, 2, 5 or 14*
Lifetime (seconds): Enter the phase 1 lifetime in seconds

* These settings require firmware version 15.12 or greater

Phase 2

Encryption: Select between AES-128, AES-192, AES-256, and 3DES encryption (multiple options can be selected)
Authentication: Select between MD5 and SHA1 authentication (both options can be selected)
PFS group: Select the Off option to disable Perfect Forward Secrecy (PFS). Select group 1, 2, or 5 to enable PFS using that Diffie Hellman group.
Lifetime (seconds): Enter the phase 2 lifetime in seconds

On May 8th 2018, changes were introduced to deprecate DES for encryption. Click here for more information.

NOTE: Please ensure the phase 2 lifetimes are equal on both ends of the tunnel whenever possible. While MX's can sometimes honor a shorter phase 2 lifetime if they're acting in response to build a tunnel, they cannot while serving as the initiator of the tunnel.

Peer availability

By default, a non-Meraki peer configuration applies to all MX-Z appliances in your Dashboard Organization. Since it is not always desirable for every appliance you control to form tunnels to a particular non-Meraki peer, the Availability column allows you to control which appliances within your Organization will connect to each peer. This control is based on network tags, which are labels you can apply to your Dashboard networks.

When "All networks" is selected for a peer, all MX-Z appliances in the organization will connect to that peer. When a specific network tag or set of tags is selected, only networks that have one or more of the specified tags will connect to that peer.