SITE-TO-SITE VPN CONFIGURATION

[D_Tau]

Good day Meraki community, I an in need of assistance in troubleshooting failed connections for site to site VPN which we have configured for a client's network.

The VPNs were fully functional for the past two weeks but has now turned RED on all VPN participating networks. The configuration had about 13 networks as SPOKES and only one (1) hub.

Is there something we are missing in our configuration or is there something else to the matter?

[SamerAl]

Hi @D_Tau,

Is it None Meraki VPN or autoVPN ( Meraki to Meraki ) you are refering to here ?

We had an issue for autoVPN yesterday but it should be resolved now, please check https://status.meraki.net/

[D_Tau]

Hello @SamerAl ,

Its is all Meraki hardware Sir, newly deployed and configured to an Organization named Botswana Police Services SDWAN...

We are aware that the autoVPN has been resolved and we have attempted restarting the devices a number of times but the problem still persists.

However, the VPNs we have configured today are fully functional yet those we configured prior to these are not reachable.

[SamerAl · Accepted solution]

Did you try to take a packet capture on the internet interface of both MX's , can you see the communication with the VPN registery happening ?

Please refer to this article for more troublshooting tips.

Also, take a look at this article for your reference on how to take packt captures on the dashboard.

[D_Tau]

We have not tried that out yet, please allow us to check then revert back to you. 

Thank you.

[D_Tau]

Not sure if it is visible there but we do get some responses over the internet packet capture on those networks with failed VPN connections.

[SamerAl]

@D_Tau,

The communication should be bidirectional between the MX IP address and the VPN registry IPs. Once that communication is established, the VPN registry will instruct both MXs to build the tunnel.

The screenshot you included doesn't show any of the IPs used by the VPN registry.

You can find the IP ranges and port numbers used for the VPN registry listed in the dashboard. Just click on the "?" at the top right, then go to "Firewall info."

if you can, pelase try to log a case with our support team and they will be able to help on this.

you can do so by navigating to the dashboard ? > Get help and cases .

[D_Tau]

Noted, should they both be visible while doing a packet capture on the internet interface?

we have seen multiple interface selections including that of the site-to-site VPN interface.

For the output shared earlier it was only captured on the Internet Interface.

[D_Tau]

This is the packet capture on the site to site VPN interface

[SamerAl]

Yes , they should both be visible while doing a packet capture on the internet interface?

[D_Tau]

We have configured another branch location as our Hub together with the HQ Hub and communication with the branch location hub is fully functional. I do believe your solution/recommendation @SamerAl has shed some light on our troubleshooting. 

Thank you kindly for your assistance.