allow ESP IP Protocol 50 in meraki mx

[FishMan]

i need to allow ESP IP Protocol 50 in meraki mx

any one could help

[AndreaB]

What do you exactly want to achieve?

MX doesn't route unencapsulated ESP traffic, but NAT-T works without any problem, hence UDP is the protocol to allow.

[alemabrahao]

Sorry, but I believe it is necessary to allow nothing.

Otherwise I suggest opening a support case.

https://documentation.meraki.com/General_Administration/Tools_and_Troubleshooting/Networking_Fundame...

[AndreaB]

It depends if the MX is the VPN terminator, or the termination is behind the MX. That's why I mentioned NAT-T.

[GIdenJoe]

A device behind an MX will be NAT'ed unless it is in concentrator mode.  In that last case you will not be able to support it.  Otherwise in the normal routed mode your ESP endpoint will just encapsulate ESP inside UDP port 4500.

The MX itself when making IPsec VPN's will always use ESP for encapsulation.

AutoVPN is proprietary and does not use standards based IPsec.