Restrict Particular VPN's to Particular VLANS

[JonathanC]

Hi,

We've got remote sites with Z3's
In the office we've got some VLANs

120

121

122

etc

etc

I'd like to setup VPNs between particular VLANs in the office and Z3's in the field. That way it ends up something like this

VLAN 120 (10.0.20.0/24) VPN <----> Z3's 192.168.31.0/24

VLAN 121 (10.0.21.0/24) VPN <----> Z3's 192.168.32.0/24

etc

Each is separate and secure from each other.

As an alternative can I make the Z3 network the same VLAN as inside the office? Not sure what you'd call that.

Hope what I'm trying to accomplish is clear.

Thanks

Jon

[alemabrahao]

Could you please explain better?

The VLAN 120 (10.0.20.0/24) VPN and VLAN 121 (10.0.21.0/24) VPN networks are Client VPN, Meraki VPN or Non-Mreaki VPN.

[JonathanC]

Meraki VPN.

The "office" has an MX64W.

[alemabrahao]

Ok, but  I didn't understand what do you want to do?

[JonathanC]

I want each of the remote networks behind each Z3 to be able to communicate to one (and only one) of VLANs at the local site.
That way a device on the Z3 network can access a server on a particular VLAN on our local net. 

[alemabrahao]

Got, take a look on this:

https://documentation.meraki.com/MX/Site-to-site_VPN/Site-to-Site_VPN_Settings#Site-to-site_VPN

https://documentation.meraki.com/MX/Site-to-site_VPN/Site-to-Site_VPN_Settings#VPN_Firewall_Rules

[Brash]

You would implement this using firewall rules.

There's different places you can apply them, but the most logical for what you're trying to achieve would be "Site-to-site outbound firewall" rules.

These are configured under "Security & SD-WAN -> Site-To-Site VPN".

Take a look at the below link for some extra info and examples

Site-to-site VPN Firewall Rule Behavior - Cisco Meraki