Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
About Frank_Liebelt
Frank_Liebelt
Comes here often
Member since Jan 12, 2022
Feb 26 2024
Community Record
7
Posts
0
Kudos
0
Solutions
Badges
Sep 6 2023
8:43 AM
The setting was of course already adjusted in advance. What about the statement that AnyConnect does not work with NAT? Is it somehow possible now? Just confused as I have already passed this statement and AnyConnect over PaloAlto (DNAT) is considered failed.
... View more
Sep 6 2023
8:35 AM
Hi Where can I decide which protocol I use? AnyConnect definitely wants to connect via SSL port 444. 443 is already taken for something else, hence 444.
... View more
Sep 6 2023
8:32 AM
Hi, i had already written in the opening of this thread that you can see in the capture that the packets arrive on the MX, but nothing goes back from there. The way (successful): PUBLIC IP -> NAT IP WAN IF -> WAN1 IP MX 12.34.56.78 -> 10.100.110.100 -> 10.100.110.99 Capture from the MX: 573 6.365300 10.100.110.100 10.100.110.99 TCP 70 [TCP Retransmission] 22785 → 444 [SYN] Seq=0 Win=64240 Len=0 MSS=1452 WS=256 SACK_PERM
... View more
Sep 5 2023
11:46 AM
HI Thanks. But this confuses me now. We had the setup with a Sophos UTM still working until a week ago. The problem has only existed since we replaced the Sophos with the Palo Alto. Ok, you would now say that the problem is the PA, because it worked before. The colleagues from PA see the problem with the MX as it does not give an answer. And in between, as always, me.
... View more
Sep 5 2023
11:37 AM
Hello everyone I'm trying desperately to get clients via AnyConnect to an MX250 behind a PaloAlto. Scenario: Meraki cluster, virtual IP of WAN1 is IP 10.100.110.99/29. The appliances themselves have 10.100.110.97/29 and 10.100.110.98/29 respectively. VLAN 3521 Inbound Firewall Layer 3: ANY to ANY On the MX, NO-NAT is enabled on WAN1. Why? There are multiple VLANs on the MX. In order to create firewall rules for the individual LANs on the PaloAlto, these must arrive with an IP from the LAN and not with the NAT IP 10.100.110.99 of the MX. The PaloAlto interface has the IP 10.100.110.100/29. VLAN is set. Process: Clients in local networks can access the Internet via WAN1->Palo Alto without any problems. So outgoing connections work. Now it's about incoming connections. On the PaloAlto there is a PolicyBased Forwarding to get from the Meraki Cloud to the MX. That works too. Now comes the AnyConnect problem. On the PaloAlto there is a DNAT that sends incoming connections on port 444 (used for AnyConnect) over IP 10.100.110.100 to the MX 10.100.110.99. These packages also arrive there. A package capture clearly shows me incoming connections from port 444 source 10.100.110.100, destination 10.100.110.99. However, apparently no packages are going back to the PaloAlto from the MX. There are no ACK packets, there is simply nothing, as if the MX discards the packets internally, but I can't change anything about it. A capture on the Palo also shows no incoming data, no drops. It's just very, very quiet on the line. Has anyone here already had experience with and/or has an idea of how I can get the scenario to run. greeting
... View more
Jan 12 2022
2:04 PM
Hi with the current setup: MX64 LAN on MX250 LAN, an L3 firewall does not work on either the MX64 or the MX250 The current setup looks like this: Transfer network 10.100.110.104/30 VLAN 4000 MX64 IP 10.100.110.105 MX250 IP 10.100.110.106 MX250 Static Route: to remote LAN 192.168.0.0/24 gw 10.100.110.105 MX64 Static Route: to local LAN 172.18.5.0/24 gw 10.100.110.106 This setup works. But as described, only without a firewall. Now let's assume that a computer with the IP 192.168.0.10 should access a server 172.18.5.99. And nothing else in the 172 LAN. I have created the following L3 rules. InboundRule that looks like this. Deny TestRule1 Any 192.168.0.10/32 Any 172.15.5.99/32 Any And an outbound rule that looks like this. Deny TestRule1 Any 172.15.5.99/32 Any 192.168.0.10/32 Any The same on the MX250. I can still reach the server without any problems. Or ping the client from the server. Even if I put a deny for both subnets, it still works. And here the Meraki support told me that it is because the two MX see themselves as clients and I cannot regulate the traffic via the firewall. That would probably only work if the local LAN was connected to the MX64. But this is not the case, as the MX64 only serves as a non-Meraki VPN gateway. Hence the idea from support to do this via a no-NAT on WAN2 of the MX64. This brings me to my problem that I can only reach the WAN2 interface from the local network and the traffic does not go through the non-Meraki VPN.
... View more
Jan 12 2022
7:32 AM
Hi, everyone, I have a problem with a setup where I use two WAN ports on an MX64 and I need communication between the WAN ports. Design: My first attempt was to set up NON Meraki VPNs via the MX64 and to connect the MX to an MX250 via a LAN port. Which has the advantage that the remote networks are available in the AutoVPN. There is also a transfer network between the MX64 and the MX250. The construct also works as expected. The only problem is that no firewall rules apply because both MX see each other as clients. I then had a brief contact with Meraki Support. There I was told that I would have to rethink the design if I wanted to do firewalling between the two MXs. For the implementation, I should realize the connection between MX64 and MX250 via WAN2. Experimental setup: WAN1 of the MX64 is connected to the Internet and the MX NON-MERAKI VPNs set up via this port. WAN2 is attached to an MX250. NO-NAT is activated on WAN2. IP configuration: MX64 WAN2 10.100.110.109/30 MX250 LAN5 10.100.110.110/30 On the MX250, the default routes for the remote VPN networks are set to the gateway 10.100.110.109. No extra routes are set on the MX64. If I now do a trace route from the MX250 to one of the VPN networks, the tracking ends at 10.100.110.109 (MX64 WAN2). Obviously, there is no routing between the WAN interfaces here. Does anyone have any idea how to get the setup suggested by Meraki Support to work?
... View more
Labels:
- Labels:
-
3rd Party VPN
-
Auto VPN
© 2024 Cisco Systems, Inc.
