Hello @AhmedBadawy  Thanks for the response So in the solution 1, we forward the udp/500 & udp/4500 ports on the ISP router public IP to the MX WAN private IP ? ... View more

Hello @JonnyM    On Fortigate side, the ISP router in front of it acts as a bridge and the Fortigate carries the public IPs directly. Details about the MX can be read below in my response to Roshan. ... View more

Hello @RoshanS    Thanks for the answer   In our case, the MX has a private IP on it's WAN interface, it is connected by a dedicated LAN to an ISP router that carries the public IP. We have no inside NAT/dNAT rules on the ISP router, only sNAT that permit the hub to reach the Meraki cloud.   We've tried to dNAT the ike trafic 500/4500 on the ISP router to the Meraki WAN IP (so a private IP), and it doesn't work. We have no logs on Meraki side and the traces on the ISP router shows no responses for the Meraki, like it drops the packets.   (Also I read somewhere - couldn't find where - that this is not a good practice to configure the ISP router as a bridge and make the Meraki carry the public IPs directly.)   Thanks ... View more

@RWelch I think we don't understand each other. The purpose of my question is to establish a tunnel between a non-meraki remote peer and a Meraki MX, but with the remote non-meraki as a dial-up and the Meraki as responder. Again my exemple:   Fortigate (dial-up) ---> Meraki (responder) ... View more

The question is : which IP i'm supposed to put as a remote IP on the Fortigate side, the one that is seen as the WAN IP on the MX on the Meraki cloud ? ... View more

Hello,   You are showing the predefined IPSec policies that configures the encryption algorithms, this is not answering my question.    Thanks, Arnaud ... View more