VPN hairpin

[jlopez_sv81]

Hello, 

Does someone know if the configuration on the diagram is possible?

I am looking connection between Azure networks (vMX) and the networks behind MX84.

[alemabrahao]

Yes, It should have to work.

[GreenMan]

No - that won't work  (hairpinning non-Meraki and AutoVPN)
Take a look here:   https://documentation.meraki.com/MX/Networks_and_Routing/MX_Routing_Behavior#AutoVPN_and_Non-Meraki_...

Why not reduce your hops / latency by building a tunnel directly from the MX84 to the VMX?   (I assume the two MX appliances are in different Orgs, hence using non-Meraki VPN to inter-connect)

[alemabrahao]

But you can configure two MX as Non-Meraki VPN Peers and the will be add on the route table. I've configured like that many times and worked as expected.

[ww]

How does the vmx learn the non meraki vpn routes  in that case?

Because normally non meraki vpn routes are not advertised  to the other autovpn participants

[jlopez_sv81]

Hello Gleen,

That was my first option, but for some reason, the non-Meraki VPN won't connect. I have a ticket opened with Meraki.

[jlopez_sv81]

This solution is not working.

Can be the issue caused by vMX and MX100 (same organization) having just 1 peer configured to MX84.

There is no way to have VPN peers configured differently in MX in the same organization, the configuration is replicated to all of them.

[GreenMan]

If both tunnels use non-Meraki VPN, this could be configured to work;   but that's not what is shown in the diagram