Hello Dears,   I have got a Lancom Router (1781va-4G) which was configured to work with Lancom Firewall. We changed the Lancom Firewall with an Cisco Meraki MX67 almost 3 months ago and the lancom router was not needed since last week. The 1781va-4G works with a sim card. How can I add this router to my network and join it to a specific subnet? I do not have physical access to the device and have to solve this problem remotely. Every answer is appreciated and welcome. Thanks in Regards for the answers.   ... View more

Hello,   we have got many Non-Meraki-VPN connections. We have got many subnets in our local network and want to share specific subnets to specific Non-Meraki-Peers. If the target gets configured only for the subnet, that we want to share, than the connection breaks up almost every 30 Minutes. Is there a way to specify, which subnets to share with which Peer? I contacted Meraki Support and got the following answer:   In the scenario where you would like to keep VPN participation on because you are using both AutoVPN and Non-Meraki VPN and you do not want the traffic destined for AutoVPN to be propagated across Non-Meraki VPN what you can do are the following: 1) Set the interesting traffic coming from the other side to only the subnets that you are interested in and not include the others in the interesting traffic. The Meraki site, because it has VPN participation enabled on all subnets, on each subnet it would indeed try to establish a Non-Meraki VPN connection with the peer advertised in the Site to Site VPN but because only the interesting traffic (a specific subnet on our Meraki end) is being advertised from the other side, the other subnets would fail to establish a VPN connection and the traffic should be dropped 2) If you believe that the transform-set established during Phase1&Phase2 negotiations included other subnets (on the Meraki side) and you are able to reach other subnets although they are not defined in the interesting traffic scope and traffic is leaking through I would recommend then to configure Site to Site VPN Outbound firewall rules and block the traffic on our side going through the Non-Meraki VPN tunnel and from the other side please set outbound firewall rules to block any incoming traffic from our side   The second time I contacted the support, I got following answer: 1) Define the public IP address & Private subnet on the Meraki side (expected from the other side) 2) Define the public IP address & Private subnet on the other side (expected from the Meraki Side (our public IP address and the VLAN/subnet defined locally on our site that you want the traffic to be sent across) 3) The other subnets/VLANs on our side, although they have VPN participation on them, should not form any VPN connection with the other side because their subnet is not expected from the other side 4) If for any reason you are able to ping other subnets (although you should not be able to) please configure S2S VPN firewall rules. S2S VPN firewall rules are always defined in mind based on the local information sent (which is ours). Basically you are blocking your subnets (on the Meraki Side) to even communicate over VPN with the particular subnet defined in the destination. The rules are locally defined to the outbound traffic. The analogy its like an Extended ACL for Cisco which you defined as close to the source as possible. 5) Another option would be on S2S VPN firewall rules to only allow the ones that you want to go through the VPN and use a Deny any statement afterwards   I trusted this answer and built a VPN-Connection to a Peer but I am having the same problem.   Does anyone have a suggestion? Thanks in Regards ... View more