I am 80% confident this will relate to multiple SA establishment. Some firewalls use a single SA for the connection between them. You add the first subnet combination to the created SA. If there is another you append it to the existing SA. Some firewalls us an SA per subnet combination. They setup an SA and add a subnet combination, and then setup another SA and add a second combination. The trouble is when you mix these two types of firewall. If a firewall that uses a single SA sees a second SA coming in - it deletes the first SA. The result is you can only ever have a single subnet combinaiton working. I believe Meraki uses an SA per subnet combination when using IKEv1. I believe when using IKEv2 you can only have one subnet combination active at a time. Note that restriction for IKEv2. The issue might also depend on which side tries to add the subnet combination (it might work one way but not the other). All of this makes it look the VPNs are randomly going up and down. The solution most likely to resolve this is to use a single subnet combination. Hopefully you can re-factor them to allow this to happen. Otherwise, what I would personally do, is put an MX in VPN concentrator mode behind your Firepower and use AutoVPN. This will 100% solve the issue. https://documentation.meraki.com/MX/Deployment_Guides/VPN_Concentrator_Deployment_Guide You oly need an MX big enough to cope with the number of spokes required (and I guess the encrypted VPN throughput you want). https://documentation.meraki.com/MX/MX_Sizing_Information/MX_Sizing_Principles
... View more
