Swapping out a Fortigate with a Meraki MX

[CarlT]

Hi All

We currently have some sites connected over some radio links, we run IPSEC tunnels over these radio links back to a main site. The radio links are all private addressing with a central internet breakout at our main site.

If we replace a Fortinet with a Meraki, will the VPNs still build to the other firewalls over this private addressing on the WAN side ?

Also at the min, we can always connect to the Fortinet on its internal WAN IP, with the Meraki I assume we could still get to its local page ?

What happens if the Meraki lost internet, would the VPNs still work ?

cheers

[alemabrahao]

You can use private addresses to configure the tunnels without any problem, as long as you have internet access.

If the MX recorder loses internet access, the tunnels will consequently go down.

It is possible to access the local status page via a private IP address.

[CarlT]

Hi, regarding the above, so if we build VPN tunnels over the private addresses via the private WAN IP's, are you saying if the MX can no longer see the internet, it will bring down these VPN tunnels ?

[alemabrahao]

You can use a link with a private IP address as long as you know the ISP's public IP address, because in the peering process you need to use the ISP's public IP address. In short, I assume you're saying the ISP provides you with CGNAT, correct?

Yes, if the MX loses internet connection, the tunnels will go down, since the MX will lose communication with the Meraki cloud.

I apologize if I'm misunderstanding what you're trying to do. If possible, please draw a simple topology for better understanding.

[CarlT]

Hi

Basically all the firewalls would sit on a private network a /24 with private WAN addresses, not carrier, the only way they will reach the internet would be via the private WAN ip, it would have a route to a central firewall, not Meraki. so all these firewalls would sit behind one NAT IP from the main firewall.

So, would they still create VPNs with each other over these addresses?

If the main internet link went down, would these "internal" VPN's go down ?

[alemabrahao]

Unfortunately, this will not work.

[CarlT]

Hi 

what is the reason it won’t work ?

[alemabrahao]

These tunnels themselves don't require public IPs; they require bidirectional connectivity for IKE/IPsec (UDP 500/4500, ESP) between the MX and the peer.

However, if I understand correctly, you're going to use the link from your main website for all the MXs. In my understanding, due to Meraki's limitations, this scenario won't work.

What I suggest is that you try to simulate this, but I'm almost 100% certain that this scenario won't work.

If you add an MX within the same network and try to connect via Client VPN, this already doesn't work and proves enough to understand that it won't work with an IPsec VPN.

[alemabrahao]

But I'll give you a better idea.

If you have spare public addresses at the site where your HUB will be located, you can connect it in parallel to your network and make all the necessary configurations (routing, firewall, etc.).

And as you replace the firewalls at the remote sites, you can add them to the auto VPN. In my view, this strategy is the smartest thing to do.

[PhilipDAth]

This sounds like the closest topology to what you describe (this assumes that all sites are running a Meraki MX).

https://documentation.meraki.com/SASE_and_SD-WAN/MX/Design_and_Configure/Configuration_Guides/Site-t...

[rhbirkelund]

Very likely that is the same concept as Meraki AutoVPN over MPLS. https://documentation.meraki.com/SASE_and_SD-WAN/MX/Design_and_Configure/Configuration_Guides/Site-t...

As long as there is an exit node to the internet where the MXes can call home, and get information about their peers, the VPN should build between the MXes directly - eventhough each peer only has privately routed IP adresses. 

The MX'es require Internet access, otherwise they won't be able to get information about eachother and establish VPN connection. However, if Internet access is lost, the VPN connection will not go down immediately, as peer information is purged over time. Internet access to the registry matters only if there's a change in contact information after the VPN tunnel goes down. 

If contact information between the peers are the same, the VPN tunnel will go up again, even if Internet access is still missing.

However, after a couple of hours, the peer information will be purged, and the tunnel will go down again. 

https://documentation.meraki.com/SASE_and_SD-WAN/MX/Design_and_Configure/Configuration_Guides/Site-t...