Meraki

Dutra · ‎Jul 23 2021

@Bruce Thank you for the answer!

Dutra · ‎Jul 22 2021

@Bruce Thank you for your answer! There is SD-WAN and Auto VPN between the Meraki MX Spoke and MX Hub. The LAN port of the Hub MX is connected to a Layer 3 switch Core (Let's say I configured a single LAN with network address 10.0.0.0 /24. So the Hub MX is 10.0.0.2 and the switch core is 10.0.0.1 ). I created a default route on the Hub MX pointing the Switch Core as the Default Gateway to reach all other networks of the company (and Internet). The static route would be 0.0.0.0 /0 next hop 10.0.0.1 Actually, the question is if I create a static route on the MX to reach some networks, the traffic coming from these networks will be subject to be processed by the firewall? Or is considered local traffic of the LAN 10.0.0.0 ?

Dutra · ‎Jul 21 2021

Hi everyone! In a project, part of a company's network will use Meraki and another part will not. Communication that is initiated from any company LAN network (Meraki or not) must be allowed to enter into Meraki LAN. The sites that will deploy Meraki devices will be in Hub spoke topology. The MX in the Data Center will operate in Routed mode. The Hub will be directly connected to a third-party Layer 3 switch Core. The core has routes to reach all the company's networks. I am considering that a remote LAN owned by the company configured with a private IP address and that is not a Meraki device is an external network from the MX point of view. What would be best suited to allow traffic initiated from a remote LAN to the LAN behind a Meraki MX? If Layer 3 Outbound Firewall rules are created on the MX with LAN Meraki as the source and the remote LAN networks as the destination, will communication initiated on the remote LAN in the inbound direction be allowed? Where should these rules be applied? On MX Hub and also on MX Spoke or just on one of them? Thank you in advance!

Dutra · ‎Feb 10 2021

Hi @cmr Thanks for helping! We are considering in this project that the MPLS network connections will be made on the WAN ports of the MX equipments, not on the LAN ports. I was wondering if the firewall rules created at the Exit MX will take effect allowing management traffic only. Please tell me your opinion. Thanks in advance!

Dutra · ‎Feb 10 2021

Hi Bruce, Thanks for the answer! So the default route has to be configured at the MPLS routers, not on the MX appliances? The MPLS network has not an exit to Internet yet but the project includes an MX appliance placed on a different site just for this purpose: for managent traffic coming from others MX appliances passing through the MPLS network breakout to Meraki Cloud through this specific MX using its Internet connection. All other traffic have to be blocked. I'm supposed to configure the firewall functions on this MX to do this job. Do you think that it will work properly? Thank you in advance!

Dutra · ‎Feb 10 2021

Hi, everyone! Hope you are doing well There are some MX appliances in Hub Spoke topology. Each MX has two uplinks: an Internet link (Primary) and the MPLS network (Secondary) connected to the WAN-1 and WAN-2 ports respectively. The feature active-active auto VPN is enabled. In the case of Internet connection failure at spoke, the management traffic from this MX appliance at remote site can be forwarded to the Hub through the Site-to-Site VPNs using the MPLS as transport and then go out to the Internet and reach the Meraki cloud? Thank you in advance!

Meraki

Community

About Dutra

Dutra

Community Record

Badges

Re: Inbound traffic of remote LAN

Re: Inbound traffic of remote LAN

Inbound traffic of remote LAN

Re: Management Traffic

Re: Management Traffic

Management Traffic