Hello everyone I'm trying desperately to get clients via AnyConnect to an MX250 behind a PaloAlto. Scenario: Meraki cluster, virtual IP of WAN1 is IP 10.100.110.99/29. The appliances themselves have 10.100.110.97/29 and 10.100.110.98/29 respectively. VLAN 3521 Inbound Firewall Layer 3: ANY to ANY On the MX, NO-NAT is enabled on WAN1. Why? There are multiple VLANs on the MX. In order to create firewall rules for the individual LANs on the PaloAlto, these must arrive with an IP from the LAN and not with the NAT IP 10.100.110.99 of the MX. The PaloAlto interface has the IP 10.100.110.100/29. VLAN is set. Process: Clients in local networks can access the Internet via WAN1->Palo Alto without any problems. So outgoing connections work. Now it's about incoming connections. On the PaloAlto there is a PolicyBased Forwarding to get from the Meraki Cloud to the MX. That works too. Now comes the AnyConnect problem. On the PaloAlto there is a DNAT that sends incoming connections on port 444 (used for AnyConnect) over IP 10.100.110.100 to the MX 10.100.110.99. These packages also arrive there. A package capture clearly shows me incoming connections from port 444 source 10.100.110.100, destination 10.100.110.99. However, apparently no packages are going back to the PaloAlto from the MX. There are no ACK packets, there is simply nothing, as if the MX discards the packets internally, but I can't change anything about it. A capture on the Palo also shows no incoming data, no drops. It's just very, very quiet on the line. Has anyone here already had experience with and/or has an idea of how I can get the scenario to run. greeting
... View more