Non-Meraki VPN peering - only use a specific local IP-subnet in Phase2

[whistleblower]

Hi,

I´ve to configure a Site-to-Site VPN Tunnel between a Meraki MX and Non-Meraki VPN Peer...
On the MX there are a bunch of IP-Subnets configured locally but I only want to use one out of them as local one to communicate with the remote side! How can this be achived? Because if my understanding is correct per default all subnets org-wide are used or I´m wrong?

[DarrenOC]

Hi @whistleblower   That is unfortunately a downside of the MX's.  You could use the site-to-site firewall rules to restrict comms.  I can't remember if its Org wide or just Network wide for the subnets piece.

[alemabrahao · Accepted solution]

Once the networks are Enabled in the VPN configuration, they will automatically be advertised in the tunnel.

If you want to remove it, you have to disable it, but it will not participate in Auto VPN either.

[whistleblower]

OK, thanks for clarification!

[whistleblower]

I´d like to ask one more question regarding that topic... I always thought that in the Phase2 of a Site-to-Site VPN connection the parameters like the Local- and Remote IP-Subnets have to match on both VPN-Peers which should form the tunnel?! How does the Meraki MX know which local IP-Subnet the remote site VPN-Peer will need to know or is the MX sending all "enabled" VPN Networks in the Phase2 for a SA? If so, isn`t this a potential security issue when peering with Non-Meraki VPN peers?

[alemabrahao]

It will send all networks that have VPN mode enabled, I don't know the engineering behind it, because Non-Meraki VPN is very limited, so it would be better to contact Meraki.

Not sure if it would work, but limiting via L3 firewall rules is a possible solution if you don't feel secure.