Standard Meraki hub and SIG connector hub interaction

Solved
Lukeli
Conversationalist

Standard Meraki hub and SIG connector hub interaction

For some time now we’ve had a standard hub and spoke topology in my organization. Specifically, there were 2 hubs and around 150 spokes (they have both hubs enabled, but we don’t use default route option as there is no need for it). All local subnets we want are advertised and routed via Meraki SD-WAN (Auto VPN). And before we proceed, let’s look at this under the assumption that we are enabling AutoVPN for all local Vlans/Subnets on all locations.

Recently, there was a need to go a step further, and introduce options like DNS filtering etc. We’ve implemented SIG (Secure Internet Gateway) hubs and they’re up and running in Meraki dashboard.
Now comes the fun part: SIG connector hubs, unlike “standard” Meraki hubs, advertise default route by default. Which means, once spoke chooses a SIG hub as a hub, all traffic (except management) will be routed via that SIG hub. And as documentation says, we must NOT check the default route checkbox, otherwise there will be issues. And that’s fine.

Standard hubs and SIG connector hubs don’t have direct connectivity on by default, also explained in the documentation. Hubs by default only mesh with hubs, and SIG hubs mesh with SIG hubs. So there’s something.
What we have problem with is what happens when a standard hub selects a SIG hub as an exit hub?
We noticed that what happens now is whatever VLAN/subnet traffic is sent from the standard hub over to SIG hub does not come back. My question is, can this actually work? Or do we have to convert those two standard hubs to spokes as well, and just use SIG hubs from now?


And then for VLANS/subnets for which we want DNS filtering, we enable AutoVPN so it gets sent to SIG hubs. For others that we don’t want DNS filtering for, we don’t enable AutoVPN. Plus we can use VPN Exlusion to just not send some traffic over to SIG hubs. Am I right or am missing something here?

Hope I made myself clear on this subject. Any help would be appreciated.

Cheers,

Milos

1 Accepted Solution
Ryan_Miles
Meraki Employee
Meraki Employee

If I'm not mistaken the hubs would need to be configured as spokes. The doc mentions it in step 5.

SIG hubs prevent hub to hub tunnels so I'm pretty sure a regular hub will not form a tunnel with a SIG hub. If someone knows differently feel free to correct me.

Ryan

If you found this post helpful, please give it Kudos. If my answer solves your problem please click Accept as Solution so others can benefit from it.

View solution in original post

3 Replies 3
Ryan_Miles
Meraki Employee
Meraki Employee

If I'm not mistaken the hubs would need to be configured as spokes. The doc mentions it in step 5.

SIG hubs prevent hub to hub tunnels so I'm pretty sure a regular hub will not form a tunnel with a SIG hub. If someone knows differently feel free to correct me.

Ryan

If you found this post helpful, please give it Kudos. If my answer solves your problem please click Accept as Solution so others can benefit from it.
Lukeli
Conversationalist

Well, that settles it then, once we go down that path, SIG hubs will be the only hubs in the network. Let's wait a few more days to see if somebody else has something more to add, then I'll close the topic. Thanks👍

Gary_Geihsler1
Meraki Employee
Meraki Employee

There is a better solution for you, Secure Connect. This is the evolution of Meraki and cloud security together. Secure Connect allows easier and more flexible ways to deploy MX sties to have the traffic inspected. Onboarding a spoke to Secure Connect does inject a default route to the spoke MX. We also can deploy MX hubs to Secure Connect which does not inject the default route. We can mimic the default route by using the Secure Connect Hubs as Exit hubs. There are flexible options how MX spokes communicate to MX hubs. Check out the Meraki Secure Connect documentation and the hub integrations here. In most cases we can move customers from Umbrella SIG to Secure Connect while retaining the same Umbrella org. 

Get notified when there are additional replies to this discussion.
Welcome to the Meraki Community!
To start contributing, simply sign in with your Cisco account. If you don't yet have a Cisco account, you can sign up.
Labels