Meraki

Community
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 

About Jsidge92

Re: Routing specific public traffic via spoke WAN

by in Security & SD-WAN
‎Sep 28 2022 3:53 PM
‎Sep 28 2022 3:53 PM
Would it possible to set up an internal subnet for a public IP as a sort of DMZ/loopback interface since it will be obscured via NAT?(eg; 2.1.1.0/32 - router IP 2.1.1.1)   This could be the public /30 WAN interface configured on MX device.   Then static route advertised into VPN would be configured as 1.1.1.1 next-hop 2.1.1.2 (Theoretical next hop at spoke site). Traffic would then be routed to site, and when reaching site, unable to find local next hop, should fall to default route of WAN?   At that point traffic would then be NAT'd, at which point it would then be privy to public routes to the desired public IP endpoint.   I know this is convoluted, but there doesn't seem to be any sort of documentation to facilitate this.   Thanks again, ... View more

Re: Routing specific public traffic via spoke WAN

by in Security & SD-WAN
‎Sep 27 2022 11:53 PM
‎Sep 27 2022 11:53 PM
Thanks for the reply!   It would be option 2, but just curious if any issues where next hop is router IP itself? Say local subnet on router is 10.1.1.0/24 - router IP 10.1.1.1   Then static route advertised into VPN would be configured as 1.1.1.1 next-hop 10.1.1.1 (Router IP and not downstream device in subnet)   This then shows other remote sites to send any traffic for 1.1.1.1 via VPN to spoke site rather than local breakout.   Once traffic is routed to site, to IP 10.1.1.1, I would then assume as no other route path for traffic, it would then egress via local WAN breakout?   Thanks againm ... View more

Routing specific public traffic via spoke WAN

by in Security & SD-WAN
‎Sep 27 2022 4:53 PM
‎Sep 27 2022 4:53 PM
Hi,   We have an external vendor where they have whitelisted the public IP from one of our SDWAN sites. We would like to direct all traffic flows from spoke sites via the Auto-VPN tunnels, to egress this spoke site.   I believe this can be best done via a static route at the desired site, advertised into the VPN. I would then list the next hop as an IP configured on the MX. My assumption here is I should not use any downstream/ external IP interface.   The expectation here is once traffic is routed to the desired site, no local routes will exist for the service, and then will egress via the public WAN interface (Default route is still via WAN).   Can anyone advise if the above is correct, or if there is any best practice around trying to consolidate specific traffic flow via certain sites?   Thanks,     ... View more
Labels:
© 2024 Cisco Systems, Inc.