I have created a policy based S2S VPN through to Meraki. I manages to connect for about a minute before the connection is dropped by Azure side. The VPN health pages from both Azure and Meraki confirm the connection is connected but I am unable to pass data through the VPN. Meraki Logs: Aug 22 16:02:28 Non-Meraki / Client VPN negotiation msg: IPsec-SA expired: ESP/Tunnel (IP ADDRESS REMOVED FOR FORUM POST)[500]->(IP ADDRESS REMOVED FOR FORUM POST)[500] spi=20513400(0x1390278)
Aug 22 16:02:28 Non-Meraki / Client VPN negotiation msg: (IP ADDRESS REMOVED FOR FORUM POST) give up to get IPsec-SA due to time up to wait.
Aug 22 16:02:22 Non-Meraki / Client VPN negotiation msg: IPsec-SA established: ESP/Tunnel (IP ADDRESS REMOVED FOR FORUM POST)[500]->(IP ADDRESS REMOVED FOR FORUM POST)[500] spi=1719290698(0x667a4b4a)
Aug 22 16:02:22 Non-Meraki / Client VPN negotiation msg: IPsec-SA established: ESP/Tunnel (IP ADDRESS REMOVED FOR FORUM POST)[500]->(IP ADDRESS REMOVED FOR FORUM POST)[500] spi=246369293(0xeaf4c0d)
Aug 22 16:02:22 Non-Meraki / Client VPN negotiation msg: not matched
Aug 22 16:02:22 Non-Meraki / Client VPN negotiation msg: ISAKMP-SA established (IP ADDRESS REMOVED FOR FORUM POST)[500]-(IP ADDRESS REMOVED FOR FORUM POST)[500] spi:2fc20dbf268e2691:9f77ad7ee133a1b9
Aug 22 16:02:22 Non-Meraki / Client VPN negotiation msg: received broken Microsoft ID: MS NT5 ISAKMPOAKLEY Settings: ! [2] IPsec/IKE parameters
!
! > IKE version: IKEv2
! + Encryption algorithm: aes-cbc-256
! + Integrityalgorithm: sha1
! + Diffie-Hellman group: 2
! + SA lifetime (seconds): 3600
! + Pre-shared key: REMOVED
! + UsePolicyBasedTS: False
!
! > IPsec
! + Encryption algorithm: esp-gcm 256
! + Integrity algorithm:
! + PFS Group: none
! + SA lifetime (seconds): 3600 This matches up with the Azure preset in the Meraki S2S setup page. We have had the exact same setup completed with a Meraki MX64 for another client which works fine. We have compared line by line that config to this new one but unable to find any differences bar the usual IP addresses and PSK.
... View more
