Site 2 Site Connection, along side Hub connections.

[mrpackethead_]

Hi..

I have a situation where I have ~200 networks connected back to 2 hubs..  It all works fine.     I have some edge case situations where i want to connect,   a few sites together directly, so the traffic does not flow via my hub...   ( it means i'm carrign the data twice as much as i need to ). 

Complicating the matter is that some of my network locations are connected on CGNAT connections. 


Is this possible?  Can i build a VPN Between them.

[RaphaelL]

Yes you can. It's called meshing.https://documentation.meraki.com/MX/Site-to-site_VPN/Site-to-Site_VPN_Settings

[Mloraditch]

I believe you could only do that by making them hubs as well. All your hubs would be meshed but your spokes need only use your primary hubs for connectivity.

[mrpackethead_]

AN interesting idea, however I could end up in a situation where i have a lot of hubs, and that woudl then mean, some of the little devices. ( such as Z4's and MX68s ) would end up with a LOT of VPN tunnels.

With a coupel of sites, it woudl be ok,  but it woudl rapidlly get unworkable,  You'd have tunnels to hubs that you dont' need direct connections to. This is somethign that i probalby am keen to avoid.

What I was thinking about was not using the AutoVPN features at all, and setting up Manual VPn tunnels, using  IPsec ( non meraki peers, even though they are merakis ).

I'd also, in many of these cases, keen to keep these routes out of the autovpn.  These site to site networks could be things that are not the main 'corporate' network..  

[PhilipDAth]

>and setting up Manual VPn tunnels, using  IPsec

You won't be able to do this since you are behind CGNAT.

[mrpackethead_]

and not the only reason i can't set them up. 😞

I was wanting to avoid using the Auto-VPN features and try to use non Meraki Peers, in a way similar to the method in the link.   The difference for me, is that the MX appliances would have been in the same org.

The org recognizes that the route you try to use to, overlaps with a Network in the org. and 'computer says no.

I can set one end up as an addtional hub.     This does however start increasing the number of VPN tunnels that are running on the devices. In the case of MX68's ( which are the bulk of my networks ), the max number is 50.     

Is there a way to select which 'Hubs' a 'Hub' will connect to, rather than all of them? 


  ( Configuring Site-to-site VPN between MX Appliances in Different Organizations - Cisco Meraki Documen... )

[PhilipDAth]

You can request Meraki support to disable hub to hub communication - but then the hubs wont be able to talk to each other without you arranging some other kind of backaul (like MPLS).

[mrpackethead_]

can that be done on a per hub <---> hub basis or is it a global config for everything.   As it turns out, my 'head-end' hubs do already have connectivity between them. 

Its these small hubs for hooking two sites together directly that are the problem children.