Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Register or Sign in
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
About svenus1977
svenus1977
Just browsing
Member since Apr 9, 2023
Apr 15 2023
Community Record
7
Posts
0
Kudos
0
Solutions
Badges
Apr 10 2023
10:31 PM
Replying to myself. Turning off the VLAN for Auto VPN does not work in my case. As turning off Auto VPN automatically breaks the IPSec tunnel. I have opened a case to investigate the issues.
... View more
Apr 10 2023
4:28 PM
Thanks @alemabrahao @PhilipDAth for the replies. I think I can get this working and would give it a try: - I have the 2 sites that definitely will be spoke, so should be fine. - I have multiple VLANs. I just need one VLAN to be disabled with AutoVPN, but then use non-Meraki IPsec peer to reach the same "disabled AutoVPN VLAN" on the other site. I have another VLAN that goes back to the AutoVPN that can reach to Hubs. The reason for this complicated design is due to the another issue I posted on the other thread, which AutoVPN enabled VLAN breaks port forwarding. Even I am using split tunnel, I can never get port forwarding to work. And the port forwarding requirement is something I cannot ignore.
... View more
Apr 10 2023
4:24 PM
I'm doing split tunnel, that's why I haven't thought of turning it off until I run out of options and give it a try. By the way, I have multiple VLANs, I just need to turn off AutoVPN for that particular VLAN that needs port forwarding to map to. I can still keep the other required VLAN participating AutoVPN.
... View more
Apr 10 2023
4:22 PM
No, it doesn't look right to me neither. I'll try to see the best option I have now, given that I am using a workaround for production traffic, falling back to the non-working config for troubleshooting is a bit challenging.
... View more
Apr 10 2023
2:37 AM
Hello experts, Can I establish IPSec peer between 2 MXes within the the same org, rather than going onto Auto VPN? I was having issue that Auto VPN breaks the port forwarding config: https://community.meraki.com/t5/Security-SD-WAN/Port-forwarding-not-working-on-MX67/m-p/190775 But eventually, I need to keep the IPSec tunnel going when the other site (currently an old Cisco router, setup as a non-meraki peer between the MX) migrates to the MX. Since I can't use Auto VPN, I wonder if the non-Meraki IPSec peer works for 2 MXes in the same organization. Thanks.
... View more
Labels:
- Labels:
-
3rd Party VPN
-
Auto VPN
-
Firewall
Apr 9 2023
2:41 AM
Found the fix myself. That VLAN if I enable AutoVPN, the port forwarding fails. Port forwarding works once I turn off AutoVPN. Not exactly sure how the two interacts but I may perhaps configure another VLAN for the AutoVPN.
... View more
Apr 9 2023
1:52 AM
My WAN 1 is down so using WAN 2 to test but that should not affect outcome. Have configured port forwarding on matching both links, LAN server confirmed is active. Done a packet capture on both sides, it appears that MX has dropped the SYN/ACK from the server and therefore 3-way handshake not completed. Removed all firewall rules (actually the rules are not blocking anyway), still the same. Any idea why MX is dropping the SYN/ACK only for port forwarding traffic? Other outbound traffic is fine.
... View more
© 2024 Cisco Systems, Inc.
