I'm trying to setup IPSec S2S VPN Tunnel to non-Meraki peer . The only thing which I found in Event Log is
|Non-Meraki VPN negotiation||msg: FIPS mode disabled|
I tried to find solution but no success , could you advice me what I can do ?
You can create Site-to-site VPN tunnels between a Security Appliance or a Teleworker Gateway and a Non-Meraki VPN endpoint device under the Non-Meraki VPN peers section on the Security & SD-WAN > Configure > Site-to-site VPN page. Simply click "Add a peer" and enter the following information:
Note that if an MX-Z device is configured with a default route (0.0.0.0/0) to a Non-Meraki VPN peer, traffic will not fail over to the WAN, even if the connection goes down.
*IKEv2 requires firmware version 15.12 or greater
When configuring NMVPN connections between 2 MXs in different organizations that are running MX15 code and above that are not using a UserFQDN and are NATed behind an upstream device, please ensure that the remote ID field of the NMVPN peer is filled out with the private IP address of the remote NATed MX.
This feature enables the use of FQDN instead of an IP address while configuring a Non-Meraki VPN peer. Using IP addresses can be tedious because with a dynamic IP address, a customer has to manually modify the Non-Meraki VPN settings on the Site-to-Site VPN page when there is an IP address change. With FQDN configuration, the hostname of the remote peer would automatically get resolved each time a connection is initiated.
“FQDN” differs from “User FQDN”. The MX resolves the FQDN to an IP address of the remote peer, whereas, “User FQDN” is used in conjunction with the IP address of the remote peer. “FQDN” identifies the remote peer and is configured in the “Public IP/Hostname” field. “User FQDN” identifies the local peer and is configured in the “Local ID” field.
MX running firmware 18.1 or higher
The FQDN of the Non-Meraki VPN peer can be configured in the Public IP/Hostname field when IKEv2 is the selected IKE version.
If the configured FQDN fails to resolve, an event will be reported in Network-wide > Eventlog on Dashboard
Meraki Appliances build IPsec tunnels by sending out a request with a single traffic selector that contains all of the expected local and remote subnets. Certain vendors may not support allowing more than one local and remote selector in a given IPsec tunnel (e.g. ASA 5500-X series firewalls running certain firmware releases); for such cases, please use IKEv1 instead.
An MX-Z device will not try to form a VPN tunnel to a non-Meraki peer if it does not have any local networks advertised.
There are three preset IPsec policies available.
If none of these presets are appropriate, the Custom option allows you to manually configure the IPsec policy parameters. These parameters are divided into Phase 1 and Phase 2.
* These settings require firmware version 15.12 or greater
On May 8th 2018, changes were introduced to deprecate DES for encryption. Click here for more information.
NOTE: Please ensure the phase 2 lifetimes are equal on both ends of the tunnel whenever possible. While MX's can sometimes honor a shorter phase 2 lifetime if they're acting in response to build a tunnel, they cannot while serving as the initiator of the tunnel.
By default, a non-Meraki peer configuration applies to all MX-Z appliances in your Dashboard Organization. Since it is not always desirable for every appliance you control to form tunnels to a particular non-Meraki peer, the Availability column allows you to control which appliances within your Organization will connect to each peer. This control is based on network tags, which are labels you can apply to your Dashboard networks.
When "All networks" is selected for a peer, all MX-Z appliances in the organization will connect to that peer. When a specific network tag or set of tags is selected, only networks that have one or more of the specified tags will connect to that peer.
Thank you for quick response . I did that already but it looks that somehow it not send any "request" for connection .In logs there is no any other vpn related entries only this "msg: FIPS mode disabled" , no any Phase 1 and Phase 2.. Can 't see also any trials on remote peer.
Do you have access on remote peer? Try to generate some traffic (ICMP for exemple).
By the way, is your link dedicated? Is your ISP using CG-NAT?
Not sure. I haven't public ip address on Meraki but 192.168... something and for sure there is NAT on ISP router . I did another trial with Opnsense in same infrastructure and I was able to setup this tunnel
Well, I have never configure Non-Meraki VPN peers with MX behind a NAT, so I'm not sure if It will work.
Maybe you should have to open a case with Meraki.
I will perform a Lab.
I just test It, and I have some considerations:
In beginning I had same issue (My MX is behind a NAT too), so I did a search about FIPS and I found IT:
Then I changed my IPsec policies configurations like this:
And guess you ? It worked. I don't like to use 3DES and MD5, but .... OK 😐
Good news, I tested again changing my IPsec policies and my password greater than 14 characters and worked
I would also like if this was resolved. I have an issue with similar symptoms
I was struggling with the same.
My MX was connected to a LAN port sitting behind my ISP router.
My colleague shared a setting that resolved this issue for my setup.
On my home ISP router, i needed to configure port forwarding towards the internal IP that my MX was using.
500UDP and 4500UDP
And these were the IKEv2 settings on the portal
I'm facing the same issues, and my MX is not behid a NAT/modem-route it get a public ip, the remote peer is a hostname (i've tested with other vendor and the tunnel goes up). I've also opened a ticket but no answer!