Regarding Site-to-site VPN

[KSM]

Hi Meraki

Non-meraki site to stie VPN Troubleshooting Contact Us

I currently have a tunnel between a Mearki MX and a Juniper SRX and AWS.

The SRX is acting as the hub, and both the MX and AWS are connected.

The MX is only connected to the SRX.

The tunneling is all good.

However, no packets are going out.

1. what is the tunnel source ip in MM?
2. When I capture SITE-TO-SITE VPN packets, I don't see any packets, is this correct?
3. Do I need to route them separately? Isn't it just a matter of declaring it on a private subnet?

[Badr-eddine]

Could you please provide additional information regarding the deployed topology? How the AWS and the SRX are connected ?

[KSM]

Yes. Similarly, AWS and SRX are connected by IPSEC.

[alemabrahao]

Can you share a topology and configuration with us?

[KSM]

I'm so sorry
I have uploaded the topology to the link below.
https://community.meraki.com/t5/Security-SD-WAN/Meraki-mx-PAT-question/m-p/215975

[GIdenJoe · Accepted solution]

If you capture on the LAN side of the MX you should see the packets coming from a client in your MX network towards your MX (source MAC address client, dest MAC address Meraki MX).  However on the WAN side you could only see ESP packets leaving your WAN IP towards the WAN IP of the SRX.  Looking inside the site 2 site VPN is definitely possible with AutoVPN but I'm not exactly sure with IPsec VPN if this works.  Should test it out 😉

In the logging you should make sure you have a CHILD_SA with all the necessary traffic selectors active before you can see traffic actually passing.  The little green dot in the VPN status page is NOT enough.

The last thing that could be wrong is if you have any IPsec VPN firewall rules on the VPN page.

[KSM]

It's a shame that outgoing packets from the LAN are captured, but SITE-TO-SITE VPN packets are not.