site to site tunnel with firepower and mx84

Solved
AshC73
Getting noticed

site to site tunnel with firepower and mx84

Hi,

 

I am trying to setup a tunnel between a firepower and mx84.

I want to use IKEv2

Phase 1 AES 256 -- SHA256 -- DH 14 - 86400

 

Phase 2 AES256 -- SHA256 -- DH 14 -- 3600

 

Will the MX84 work with the above? 

I have had a quick test but connection wasn't made.

 

Thank you in advance.

 

Ash

1 Accepted Solution
alemabrahao
Kind of a big deal
Kind of a big deal

It should have worked. Did you check de Preshared's secret?

I am not a Cisco Meraki employee. My suggestions are based on documentation of Meraki best practices and day-to-day experience.

Please, if this post was useful, leave your kudos and mark it as solved.

View solution in original post

10 Replies 10
alemabrahao
Kind of a big deal
Kind of a big deal

It should have worked. Did you check de Preshared's secret?

I am not a Cisco Meraki employee. My suggestions are based on documentation of Meraki best practices and day-to-day experience.

Please, if this post was useful, leave your kudos and mark it as solved.
alemabrahao
Kind of a big deal
Kind of a big deal

Try to specify the remote id 

I am not a Cisco Meraki employee. My suggestions are based on documentation of Meraki best practices and day-to-day experience.

Please, if this post was useful, leave your kudos and mark it as solved.
AshC73
Getting noticed

So would that be the public or private ip of the firepower?

alemabrahao
Kind of a big deal
Kind of a big deal

try the public IP

I am not a Cisco Meraki employee. My suggestions are based on documentation of Meraki best practices and day-to-day experience.

Please, if this post was useful, leave your kudos and mark it as solved.
AshC73
Getting noticed

Yes, the key was correct.

I am going to try again to see if there is anything is missed.

KarstenI
Kind of a big deal
Kind of a big deal

How many networks do you have on each side of the VPN? If more than one, try using IKEv1.

https://documentation.meraki.com/MX/Site-to-site_VPN/IKEv1_and_IKEv2_for_non-Meraki_VPN_Peers_Compar...

GIdenJoe
Kind of a big deal
Kind of a big deal

The bulk of the problems stem from having one or both devices behind a NAT which makes the IKE remote ID a problem if you cannot customize it or do it incorrectly.

 

Also make sure you configure a policy based VPN and not a route based one since Meraki does not support the latter yet.

AshC73
Getting noticed

Thank you, we are going to try it again next Wednesday as it is a live system.

We currently have a tunnel but use IKEv1 and it is a ASA.


Fingers crossed.

AshC73
Getting noticed

Tunnel its up. 

I didnt need to add remote peer ID.

 Settings i posted all worked.

 

Thank you all for your replies.

thomasthomsen
Kind of a big deal

So what was the problem ?

Was it just the Pre-shared key ?

Get notified when there are additional replies to this discussion.
Welcome to the Meraki Community!
To start contributing, simply sign in with your Cisco account. If you don't yet have a Cisco account, you can sign up.
Labels