SD-WAN & VPN

Holli69
Getting noticed

SD-WAN & VPN

Hi,

I've q question. We have a branch side with an MX95, WAN 1 is Fiber, WAN 2 is DSL, and in the Data Center an MX250-HA VPN-Concentrator. 

Because both are in different Organizations, we build a non-Meraki VPN-Tunnel from WAN 1 (MX95) to VPN-Concentrator(MX250-HA).

Everything works fine and the tunnel is stable, but what will happen, if WAN 1 will go offline?

The tunnel is not built over WAN 2 (DSL) in case of a connection loss of WAN 1 (failover), right?

WAN failover and fallback behavior are set to graceful.

Is the only possibility to build the tunnel in case of loss of connectivity of WAN 1 and failover to WAN 2 via dynamic DNS?

 

5 REPLIES 5
CptnCrnch
Kind of a big deal
Kind of a big deal

Is there any specific reason why your branch is not a separate network within your Org? This would make your life a lot easier when it comes to using AutoVPN and all of its beauties.

 

If it really needs to be 3rd party VPN, https://documentation.meraki.com/MX/Site-to-site_VPN/Tag-Based_IPsec_VPN_Failover could prove useful for you.

DarrenOC
Kind of a big deal
Kind of a big deal

I’m guessing they’re two separate Orgs because of the license constraints of not allowing mixed MX license types 

Darren OConnor | doconnor@resalire.co.uk
https://www.linkedin.com/in/darrenoconnor/

I'm not an employee of Cisco/Meraki. My posts are based on Meraki best practice and what has worked for me in the field.

@DarrenOC: Yes, you're right, we've two different License Types of the MX's, we've many org's, because each Org has it's own budget for IT equipment and licenses.

cmr
Kind of a big deal
Kind of a big deal

@Holli69 if you change orgs to per device licensing then you can keep the budgets separate without needing separate orgs.  This still doesn't allow different levels of MX license (they all have to be either enterprise, advanced or sdwan plus).  Could that help?

PhilipDAth
Kind of a big deal
Kind of a big deal

If WAN1 fails, the non-Meraki site to site VPN will go down.

 

If you want to make it bulletproof, create a transit VLAN at your data centre.  Add an MX for each organisation in VPN concentrator mode.  Then you can use AutoVPN within each org, and route between the organisations using a layer 3 gateway (such as the MX250, a layer 3 switch, etc).

Get notified when there are additional replies to this discussion.
Welcome to the Meraki Community!
To start contributing, simply sign in with your Cisco account. If you don't yet have a Cisco account, you can sign up.
Labels