Site to Site Client Connection issue

AdamVanDusen
Comes here often

Site to Site Client Connection issue

Hello,

 

I am setting up my Meraki MX250 and MX68 for site to site VPN. I am having an issue that I can't resolve. My clients on the 68 are not getting IP addresses from my Servers behind the 250.

 

On the MX250 I have a VLAN with the scope of 192.168.4.0/24 and this is where my servers sit. On the MX68 I have a VLAN of 192.168.5.0/24 and that is the client scope at the remote site.

 

I have the MX68 relaying the 5.0/24 VLAN to the DHCP servers on the other subnet.

 

My VLAN 4.0/24 is on port 3 of the MX250 and it is a trunk port. My VLAN 5.0/24 is on port 3 of the MX68 and it is an access port with the access policy as "Open".

 

Both MXs are in Routed mode with MAC Address Client Tracking.

 

My DHCP servers have both a 192.168.4.0/24 and 192.168.5.0/24 scope set up. The 003 Router option on my 5.0 scope is set to 192.168.5.1 and that is the same as my VLAN MX IP gateway.

 

One thing I have noticed is that if I add 192.168.4.1(gateway for MX250) to the 192.168.5.0/24 scope Router option, the MX68 will then see the client but the client will still not be reachable by ping or have internet access.

 

Sorry, this was a lot of words but I am not sure what info might be needed.

7 REPLIES 7
ww
Kind of a big deal
Kind of a big deal

Do you have more the one vlan on the mx68? And is the highest vlan included in the vpn?

 

https://documentation.meraki.com/MX/DHCP/Configuring_DHCP_Relay

 

Make sure to read the blue notes

AdamVanDusen
Comes here often

Thanks for the link.  I have one vlan on each MX so even though I am not sure what "highest" means, I would assume they are.

rymiles
Meraki Employee

If you give a client a static IP does it work? That would verify the tunnel is up and routing is ok and the issue is with the DHCP server or reachability to it. Can the MX68 ping the DHCP server IP?

I can't reach the client from here so I am going to go to the site on Sunday and work on it.  I will let you know what I find.  Thanks for the reply!

If the MX68 is online though you can use the tools tab and source a ping from it to the DHCP server IP to test if that's reachable

So I just checked the logs and I am gettings some things I don't understand.  It looks like the client is getting an IP address now(I made some changes).

AdamVanDusen_0-1638554187426.png

But I am also getting an IP address / vlan mismatch?

AdamVanDusen_1-1638554241450.png

 

AdamVanDusen
Comes here often

Just to close this out. I did get everything working just not the way I would have liked.  I let the MX68 play DHCP for that remote office and set it up to give out the scope I wanted.  Now everything is working fine.  I never did VLAN to pass DHCP relay.

Get notified when there are additional replies to this discussion.
Welcome to the Meraki Community!
To start contributing, simply sign in with your Cisco account. If you don't yet have a Cisco account, you can sign up.
Labels