Site-to-Site VPN Can't Access Internal Network

[Heath_Rose]

I have (2) Meraki MX75’s and am trying to get them to work as a Hub and Spoke. I have one of the MX75’s in our data center and have the WAN1 port connected to an external public IP 168.166.x.x address. The 168.166.x.x address only has access to the internet and does not have access to our Internal Company Network.

I have another port/IP address of 10.1.x.x and have it connected to the WAN2 port on the Meraki MX75. I have the Site-to-Site Auto VPN working between both the Hub and Spoke and have internet access on the poke but I can not figure out how to get the spoke access to our Internal 10.x.x.x network.

Does anyone have experience with this or any ideas on how to accomplish this?

[alemabrahao]

How are you testing this?

Do you have any firewall rules configured?

[Heath_Rose]

I have a computer connected to the MX75 spoke and can connect to the internet over the tunnel, but I cannot connect to the internal 10.0.0.0/8 network. I cannot ping or connect to anything on the 10.0.0.0/8 network at all including DNS.

I have a firewall rule on the Hub 

[alemabrahao]

There are firewall rules in the VPN as well.

https://documentation.meraki.com/SASE_and_SD-WAN/MX/Design_and_Configure/Configuration_Guides/Site-t...

Another point is, do you have active firewalls on the machines? It could be the system's own firewall blocking communication.

[Heath_Rose]

So when talking about the MX75 Hub, I have (2) network connections.

Connection 1 is the public Internet connection that I have connected to WAN1

and Connection 2 is the Enterprise Network 10.0.0.0/8 I have connected to WAN2

Would this be the proper way to connect this?

[alemabrahao]

The WAN will not communicate with the LAN; this is expected.

You need a new network (VLAN interface) configured on the LAN.

Communication is LAN-to-LAN.

[ww]

Meraki wan interfaces need internet connectivity.

You should connect it to the lan side and add a static 10.0.0.0/8 route to the next hop.

https://documentation.meraki.com/SASE_and_SD-WAN/MX/Design_and_Configure/Configuration_Guides/Networ...

[alemabrahao]

Why a static route? You can simply configure a new SVI on the same network and the route will be automatically advertised in the auto VPN.