SD-WAN & VPN

[Holli69]

Hi,

I've q question. We have a branch side with an MX95, WAN 1 is Fiber, WAN 2 is DSL, and in the Data Center an MX250-HA VPN-Concentrator. 

Because both are in different Organizations, we build a non-Meraki VPN-Tunnel from WAN 1 (MX95) to VPN-Concentrator(MX250-HA).

Everything works fine and the tunnel is stable, but what will happen, if WAN 1 will go offline?

The tunnel is not built over WAN 2 (DSL) in case of a connection loss of WAN 1 (failover), right?

WAN failover and fallback behavior are set to graceful.

Is the only possibility to build the tunnel in case of loss of connectivity of WAN 1 and failover to WAN 2 via dynamic DNS?

[CptnCrnch]

Is there any specific reason why your branch is not a separate network within your Org? This would make your life a lot easier when it comes to using AutoVPN and all of its beauties.

If it really needs to be 3rd party VPN, https://documentation.meraki.com/MX/Site-to-site_VPN/Tag-Based_IPsec_VPN_Failover could prove useful for you.

[DarrenOC]

I’m guessing they’re two separate Orgs because of the license constraints of not allowing mixed MX license types 

[Holli69]

@DarrenOC: Yes, you're right, we've two different License Types of the MX's, we've many org's, because each Org has it's own budget for IT equipment and licenses.

[cmr]

@Holli69 if you change orgs to per device licensing then you can keep the budgets separate without needing separate orgs.  This still doesn't allow different levels of MX license (they all have to be either enterprise, advanced or sdwan plus).  Could that help?

[PhilipDAth]

If WAN1 fails, the non-Meraki site to site VPN will go down.

If you want to make it bulletproof, create a transit VLAN at your data centre.  Add an MX for each organisation in VPN concentrator mode.  Then you can use AutoVPN within each org, and route between the organisations using a layer 3 gateway (such as the MX250, a layer 3 switch, etc).