Site-to-Site VPN Meraki MX behind NAT and Azure

[Mateen]

Hei,

Does anyone know that if Meraki MX is behind NAT, is it possible to make VPN tunnel with Azure vpn-gw ? I am using beta firmware and activated ikev2 via support. Azure documentation says no. but is there any workaround ? portforwarding etc..

[Nash]

Is the device in front of your MX using 500/4500 for anything?

If not, what happens when you setup port forwarding?

Alternately, would the vMX100 work for you?

[Mateen]

Device in front is a 4 G router. I have tried port forwarding but tunnel is not coming online. vMX is not an option.

[Nash · Accepted solution]

Is it possible to put the 4G router into passthrough/bridge/whatever mode and slap the WAN IP directly on the MX?

[Mateen]

Tried ipsec passthrough mode and a dmz mode which was the most open option on tp link mr400 4g router. In all settings the router gives a private ip to mx. Azure does not like that.

[Nash]

Mm, no, no, it's not going to.

Is your provider on the 4G router doing carrier-grade NAT? If so, I don't think there's any way you're going to get around that. AutoVPN to a vMX could cope, but you've said that's not an option.

[PhilipDAth]

For 4G to work you would need a static IP from your carrier - and very few carriers will do that.