Confirm that all Phase 1, Phase 2 and PSK settings are the same on both sites. Non-Meraki VPN peers You can create Site-to-site VPN tunnels between a Security Appliance or a Teleworker Gateway and a Non-Meraki VPN endpoint device under the Non-Meraki VPN peers section on the Security & SD-WAN > Configure > Site-to-site VPN page. Simply click "Add a peer" and enter the following information: A name for the remote device or VPN tunnel. What IKE version to use (IKEv1 or IKEv2)* The public IP address of the remote device. The Remote ID of the remote peer. This is an optional configuration and can be configured to the remote peer’s UserFQDN (e.g. user@domain.com), FQDN (e.g. www.example.com) or IPv4 address as needed. Which of these values you use is dependent upon your remote device. Please consult its documentation to learn what values it is capable of specifying as its remote ID, and how to configure them (e.g. crypto isakmp identity for ASA firewalls The subnets behind the third-party device that you wish to connect to over the VPN. 0.0.0.0/0 can also be specified to define a default route to this peer. Note that if an MX-Z device is configured with a default route (0.0.0.0/0) to a Non-Meraki VPN peer, traffic will not fail over to the WAN, even if the connection goes down. The IPsec policy to use. The preshared secret key (PSK). Availability settings to determine which appliances in your Dashboard Organization will connect to the peer. *IKEv2 requires firmware version 15.12 or greater When configuring NMVPN connections between 2 MXs in different organizations that are running MX15 code and above that are not using a UserFQDN and are NATed behind an upstream device, please ensure that the remote ID field of the NMVPN peer is filled out with the private IP address of the remote NATed MX. Non-Meraki VPN Peering with FQDN This feature enables the use of FQDN instead of an IP address while configuring a Non-Meraki VPN peer. Using IP addresses can be tedious because with a dynamic IP address, a customer has to manually modify the Non-Meraki VPN settings on the Site-to-Site VPN page when there is an IP address change. With FQDN configuration, the hostname of the remote peer would automatically get resolved each time a connection is initiated. “FQDN” differs from “User FQDN”. The MX resolves the FQDN to an IP address of the remote peer, whereas, “User FQDN” is used in conjunction with the IP address of the remote peer. “FQDN” identifies the remote peer and is configured in the “Public IP/Hostname” field. “User FQDN” identifies the local peer and is configured in the “Local ID” field. Supported Products: MX running firmware 18.1 or higher Requires IKEv2 Configuration The FQDN of the Non-Meraki VPN peer can be configured in the Public IP/Hostname field when IKEv2 is the selected IKE version. The default behavior of the MX is to set remote_id to FQDN if it is not explicitly added in the dashboard "Non-Meraki VPN peers" settings. Please note, the remote id on one peer needs to match the local id on the other peer for the tunnel to be established. If the configured FQDN fails to resolve, an event will be reported in Network-wide > Eventlog on Dashboard NOTE For IKEv2 Meraki Appliances build IPsec tunnels by sending out a request with a single traffic selector that contains all of the expected local and remote subnets. Certain vendors may not support allowing more than one local and remote selector in a given IPsec tunnel (e.g. ASA 5500-X series firewalls running certain firmware releases); for such cases, please use IKEv1 instead. An MX-Z device will not try to form a VPN tunnel to a non-Meraki peer if it does not have any local networks advertised. IPsec policies There are three preset IPsec policies available. Default: Uses the Meraki default IPsec settings for connection to a non-Meraki device AWS: Uses default settings for connecting to an Amazon VPC Azure: Uses default settings for connecting to a Microsoft Azure instance If none of these presets are appropriate, the Custom option allows you to manually configure the IPsec policy parameters. These parameters are divided into Phase 1 and Phase 2. Phase 1 Encryption: Select between AES-128, AES-192, AES-256, and 3DES encryption Authentication: Select MD5, SHA1 or SHA256* authentication Diffie-Hellman group: Select between Diffie-Hellman (DH) groups 1, 2, 5 or 14* Lifetime (seconds): Enter the phase 1 lifetime in seconds * These settings require firmware version 15.12 or greater Phase 2 Encryption: Select between AES-128, AES-192, AES-256, and 3DES encryption (multiple options can be selected) Authentication: Select between MD5 and SHA1 authentication (both options can be selected) PFS group: Select the Off option to disable Perfect Forward Secrecy (PFS). Select group 1, 2, or 5 to enable PFS using that Diffie Hellman group. Lifetime (seconds): Enter the phase 2 lifetime in seconds On May 8th 2018, changes were introduced to deprecate DES for encryption. Click here for more information. NOTE: Please ensure the phase 2 lifetimes are equal on both ends of the tunnel whenever possible. While MX's can sometimes honor a shorter phase 2 lifetime if they're acting in response to build a tunnel, they cannot while serving as the initiator of the tunnel. Peer availability By default, a non-Meraki peer configuration applies to all MX-Z appliances in your Dashboard Organization. Since it is not always desirable for every appliance you control to form tunnels to a particular non-Meraki peer, the Availability column allows you to control which appliances within your Organization will connect to each peer. This control is based on network tags, which are labels you can apply to your Dashboard networks. When "All networks" is selected for a peer, all MX-Z appliances in the organization will connect to that peer. When a specific network tag or set of tags is selected, only networks that have one or more of the specified tags will connect to that peer.
... View more