Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Become a member of the Cisco Meraki Community today
Get answers from our community of experts in record time.
Join now- About jOMeraki2
About jOMeraki2
jOMeraki2
Getting noticed
Member since Jun 13, 2022
9 hours ago
Community Record
50
Posts
4
Kudos
1
Solution
Badges
2 weeks ago
what is VPN full-tunnel exclusion now includes source-based and NBAR application-based exclusion definitions.
... View more
4 weeks ago
"But in my case, I want the http and https traffic to go through a dedicated tunnel. How would this integration help me?"
... View more
Nov 26 2025
3:11 AM
Cisco ai awnser me Need to route only HTTP/HTTPS over Non-Meraki VPN Tunnel AI Assistant 08:45 AM To route only HTTP/HTTPS traffic (TCP ports 80 and 443) over a Non-Meraki VPN tunnel on a Meraki MX, use the VPN Full-Tunnel Exclusion feature. This allows you to define application, IP, or URL-based rules for local internet breakout or VPN routing. Here’s how you can achieve this: Go to Security & SD-WAN > Configure > Site-to-site VPN in the Meraki Dashboard. Under Non-Meraki VPN peers, add your VPN peer and set the "Private subnets" to 0.0.0.0/0 if you want to send all internet-bound traffic through the tunnel. To route only HTTP/HTTPS, use the VPN Full-Tunnel Exclusion feature: Navigate to Security & SD-WAN > Configure > SD-WAN & traffic shaping. Create a VPN exclusion rule for all traffic except HTTP/HTTPS, so only HTTP/HTTPS is routed over the VPN tunnel, and other traffic uses the local internet breakout. This approach allows you to selectively route only HTTP/HTTPS traffic over your Non-Meraki VPN tunnel while keeping other traffic on the local WAN. For detailed steps and best practices, refer to the following documentation: VPN Full-Tunnel Exclusion (Application and IP/URL Based Local Internet Breakout) Site-to-Site VPN Settings If you need step-by-step configuration guidance or have a specific scenario, let me know. Positive feedback Negative feedback You yes pls AI Assistant 08:51 AM Here is a step-by-step guide to route only HTTP/HTTPS traffic over a Non-Meraki VPN tunnel using VPN Full-Tunnel Exclusion on Meraki MX: Step 1: Configure the Non-Meraki VPN Peer Go to Security & SD-WAN > Configure > Site-to-site VPN in the Meraki Dashboard. Under Non-Meraki VPN peers, click Add a peer. Enter the peer details (Name, Public IP, etc.). For Private subnets, enter 0.0.0.0/0 to allow all internet-bound traffic to be routed through the tunnel. Step 2: Enable VPN Participation for Relevant Subnets In the same Site-to-site VPN page, select the subnets that should participate in the VPN. Step 3: Configure VPN Full-Tunnel Exclusion Go to Security & SD-WAN > Configure > SD-WAN & traffic shaping. Scroll to the VPN traffic section. Add a VPN exclusion rule: Set the rule to match all traffic except HTTP/HTTPS (TCP ports 80 and 443). This ensures only HTTP/HTTPS traffic is routed over the Non-Meraki VPN tunnel, while other traffic uses the local internet breakout. Step 4: Save and Apply Changes Review your configuration and click Save. Step 5: Verify Tunnel Status Go to Security & SD-WAN > Monitor > VPN Status to confirm the tunnel is active. Reference Documentation: VPN Full-Tunnel Exclusion (Application and IP/URL Based Local Internet Breakout) Site-to-Site VPN Settings If you need help with the exact rule syntax or screenshots, let me know. Positive feedback
... View more
Nov 25 2025
9:47 PM
Hello everyone, I’m working with several clients who require the ability to route only HTTP and HTTPS traffic (ports 80/443) through a Non-Meraki Site-to-Site VPN tunnel, while keeping all other internet traffic going out normally through the MX WAN. From what I know, the MX supports subnet-based routing only for Non-Meraki VPN peers, not port-based or policy-based routing. Before confirming this limitation to my clients, I would like to check with the community: Is there any method or workaround to route only specific ports (80/443) through a Non-Meraki VPN? Any alternative design or setup that can achieve this? Has anyone successfully implemented something similar? If there is no supported solution, we will unfortunately need to remove the MX from several customer sites and use another firewall vendor that supports this requirement. Any insights or recommendations would be greatly appreciated. Thank you!
... View more
Labels:
- Labels:
-
3rd Party VPN
Nov 12 2025
10:47 PM
Hi everyone, I need to establish multiple Site-to-Site VPNs with different customers, but they all use the same internal subnet (for example, 192.168.1.0/24). I only have control over my side of the VPN — I cannot make changes on the customer firewalls. I’m open to using additional devices on my side if needed, but I mainly want to understand the concept: is it feasible to handle overlapping subnets using NAT per tunnel or any other method? Also, is this approach possible with Cisco Meraki devices, or would it require other Cisco platforms? Thanks in advance for any guidance.
... View more
Labels:
- Labels:
-
Firewall
Oct 21 2025
8:18 AM
Yes, it is different. In this case, I am dealing with two devices within the same organization, and they are connected via Auto VPN, unlike the previous instance.
... View more
Oct 21 2025
4:58 AM
I have two MX devices (MX1 and MX2) in the same organization connected via Auto VPN. MX1 is configured as the default route (exit hub) for MX2. I’d like to know if it’s possible to create a port forwarding rule on MX1 that forwards traffic to a device located behind MX2. Example setup: MX1 (main site, default route) MX2 (branch site, connected via Auto VPN) I want to forward a specific port from MX1’s public IP to a private IP behind MX2. Is this supported, or should the port forwarding be configured only on MX2’s WAN directly? Any best practices or workarounds would be appreciated.
... View more
Labels:
- Labels:
-
Auto VPN
Oct 19 2025
12:05 AM
Hi, I would like to confirm how Cisco Meraki MX handles VPN connections with non-Meraki peers. In my experience, the VPN tunnel only comes up when traffic is initiated from the Meraki side. Does this mean that Meraki uses a policy-based IPSec VPN in such cases, rather than a route-based VPN? Thanks in advance for clarifying.
... View more
Labels:
- Labels:
-
3rd Party VPN
Oct 16 2025
3:44 AM
Thanks for the clarification. Since S2S AutoVPN isn’t an option, I wanted to ask specifically about port forwarding — would it be possible to set it up on S1 to achieve similar functionality?
... View more
Oct 16 2025
3:15 AM
Unfortunately, I cannot place both MX appliances in the same organization as they belong to two different companies. However, I do have access to both devices.
... View more
Oct 16 2025
2:13 AM
Hello Meraki Team / Community, I have a scenario with two Meraki sites connected via a Site-to-Site VPN: - Site 1: connected to the Internet, could potentially act as an Exit Hub. - Site 2: contains a device in its LAN with IP 10.200.133.11 that I need to access from the Internet. Please note that these two sites are in **different Meraki organizations**. I know how to set up Port Forwarding on the site where the server resides, but in this scenario, the device is in Site 2. I would like to know if it is possible to: 1. Make Site 1 act as an Exit Hub. 2. Configure Port Forwarding on the WAN interface of Site 1 to reach the device in Site 2 (across the VPN). I will attach a diagram showing the topology and the expected path for the Port Forwarding. If direct Port Forwarding over the VPN is not supported, what are the recommended alternatives to achieve the same result? Thank you for your guidance.
... View more
Labels:
- Labels:
-
3rd Party VPN
Oct 12 2025
4:10 AM
Hello Meraki Community, I have a scenario where I want all traffic related to YouTube (or video streaming in general) to exit through my secondary Internet link Is it possible to achieve this using SD-WAN on Meraki MX devices? If yes, could you provide guidance or best practices on how to configure this?
... View more
Sep 24 2025
3:21 AM
Hello Community, I’ve been looking into implementing Zero Trust with Cisco Meraki, and I actually went through the Cisco “What is SASE?” module on the developer site. Cisco DevNet But I felt it was somewhat abstract and didn’t get a clear picture of how to actually apply Zero Trust in a real-world Meraki deployment. So I’d like to ask: In general, what are the essential components and integrations needed (Meraki MX, MR, Systems Manager, Umbrella, Azure AD, Duo, etc.)? Has anyone here deployed Zero Trust using Meraki and can share their architecture, lessons learned, or pitfalls? Is there a trial or demo setup I can try to see how it works in practice before deep diving? Thanks in advance for your insights!
... View more
Jul 16 2025
10:37 AM
One quick question — do IPS and AMP on the MX67/MX85 only inspect traffic going to/from the internet (WAN), or do they also work on internal routed traffic (LAN-to-LAN), such as traffic between users and servers? Just trying to understand what kind of protection applies within the LAN when using a Layer 3 switch for internal routing.
... View more
Jul 16 2025
9:59 AM
Thanks for the explanation, but I’m still having trouble fully understanding the setup — especially the part about the /30 between the firewalls and avoiding NAT internally. Would it be possible for you to clarify it further with a simple diagram or drawing? I have an MX67 and an MX85, and I’m trying to understand the best way to separate internal traffic from internet-bound traffic without doing NAT between them.
... View more
Jul 16 2025
5:41 AM
1 Kudo
i everyone, I’m working on a network setup where I have a Meraki MX firewall connected directly to the internet. Due to government security requirements, I need to add a second firewall between the LAN and a dedicated server segment. In this design: The Meraki MX 67 is the edge firewall connected to the internet. -> average client: 250 user The second Mx 85 firewall will sit between the LAN and the internal servers. Number of server 2 hp del 380 g10 with 2 vm erp system? From the server side, this second firewall will act as the "internet gateway" (via the MX). I’m concerned about NAT behavior, routing, and potential visibility issues (like client tracking, traffic shaping, etc.) when Meraki is not the final hop to the server. I noticed the “NAT Exceptions” / “Manual NAT” feature on Meraki, and I’m trying to understand if it can help in this case. Question: What’s the recommended best practice for this kind of deployment using Meraki MX?Any advice or design considerations to avoid double NAT issues, maintain security, and preserve Meraki’s visibility? Thanks in advance!
... View more
Jan 25 2025
10:12 PM
This issue happened to me with the same model, and the solution was that they processed an RMA for me.
... View more
Jan 25 2025
10:06 PM
Do we really pay thousands of dollars just to manually block things ourselves? What's the point? It seems like I'll be switching to FortiGate. What is this firewall even? They don't even care about HTTPS inspection. This isn't a firewall; it's just a high-end router with extra features
... View more
Jan 25 2025
10:04 PM
Hello everyone, thank you so much for your help! I just noticed that I’m getting older links and outdated topics. We’re in 2025 now, and I’ve done quite a bit of searching before reaching out here."
... View more
Jan 22 2025
11:57 PM
Why doesn’t Meraki block VPN applications? This is ridiculous! I’ve already blocked them using the content filter, yet it still can’t use Layer 7 to properly block VPNs. This is so frustrating. What’s the point of having it if it can’t handle such scenarios? You might say it’s because of port 443, but even the most popular VPN apps aren’t getting blocked. My employees are using them freely, as if there’s no firewall in place. It’s extremely annoying
... View more
Labels:
- Labels:
-
Firewall
Jan 16 2025
2:48 AM
Does Systems Manager support Autopilot, or is there something similar for zero-touch configuration?
... View more
Labels:
- Labels:
-
Enrollment
Jan 16 2025
1:37 AM
We need to make a purchase, but we want to compare first. Can someone assist me with that? # Feature Question Yes No Partially Notes 1 Device Enrollment & Provisioning * Does your solution support zero-touch enrollment for Android, Apple, Samsung, and Windows devices? 2 Device Inventory Management * How does your solution help us manage and track our mobile devices? 3 Policy Management * Does your solution allow us to create and enforce security and configuration policies for our mobile devices? 4 Application Management * Does your solution allow us to manage and distribute applications to our mobile devices? * Does it support app whitelisting and blacklisting? 5 Security Features * Does your solution offer remote lock/wipe capabilities? * Does it integrate with VPN and encryption solutions? 6 OS Updates & Patch Management * Does your solution automate or simplify the process of updating operating systems and installing patches on our mobile devices? 7 Compliance Monitoring * Does your solution allow us to monitor our mobile devices for compliance with company policies and security regulations? 8 Remote Troubleshooting * Does your solution offer remote troubleshooting capabilities for our mobile devices? 9 User Self-Service Portal * Does your solution offer a user self-service portal for employees to manage their devices? 10 Directory Services Integration * Does your solution integrate with Active Directory (AD) or Azure Active Directory (Azure AD) for user authentication and policy management? 11 User Training & Documentation * Does your company offer user training and documentation for your MDM solution? 12 Data Backup & Recovery * Does your solution offer data backup and recovery options for our mobile devices? * Does it integrate with OneDrive or Microsoft 365 for data backup? 13 Scalability * Can your solution scale to accommodate growth in the number of mobile devices we manage?
... View more
Labels:
- Labels:
-
Other
Jan 15 2025
7:05 AM
I want to protect the servers from the user. This is a requirement from a state security institution to have a firewall placed before the servers, not the internet. I also have an MX67 as an edge device.
... View more
My Accepted Solutions
| Subject | Views | Posted |
|---|---|---|
| 3413 | Dec 7 2022 9:45 PM |
My Top Kudoed Posts
© 2025 Cisco Systems, Inc.
