Cisco Secure Connect Sites - Meraki SD-WAN Integration

Site Enrollment

There are two main options for connecting networks or sites to Secure Connect Data Centers:

1. Region (Hub devices deployed are referred to as Enhanced Head-End) is available in regions with Secure Connect Complete services:

• Is the preferred method offering quick enrollment, and speed of up to 500 Mbps per tunnel.
• Enables branch-to-branch connectivity (East/West interconnect) as well as secure internet access for branch users.
• Sites can be added by clicking the "Add Sites" button, which allows the selection of MX networks to be assigned to a region.
• The cloud fabric provisions each hub device with a platform type CPSC-HUB, and adds it to a new network and name prefixed with "Secure Connect-<DC name>."  
• Region hub devices with no associated branches will have their networks cleaned up after the last branch is unenrolled
• Hub devices will remain listed in your Organization > Configure > Inventory page, for re-use in future provisioning tasks

2. Cloud Hub in regions with Secure Connect Foundation services:

• This legacy method is only required for branches where the nearest region only supports Foundation services.
• Branches connected to Cloud Hubs can only support the internet access use case.  East/West internet use case is not supported.
• Connecting via Cloud Hubs involves two steps: use "Configure Cloud Hubs" button to provision and name the Hub in the nearest region and then use "Add Sites" button to enroll the sites to that Hub.
• The associated hub device platform type is UMB-SIG, and its network name is postfixed "<custom hub name>-<DC name>".
• The hub network can be deleted using Configure Cloud Hubs button in Sites page.

Organizations holding a Foundation license should enroll in the nearest Complete Region whenever possible. If the closest region is Foundation-only, Cloud Hubs need to be set up in advance.

Understanding the Data Center Regions

Secure Connect Data Center Regions are designated Complete and Foundation capable.

• Regions that are not yet Complete capable (indicated as TBD for Complete but have Foundation) will require Cloud Hubs to be set up beforehand for branches to enroll in Secure Connect. Branches in these regions lack the East/West Private Access interconnect but can utilize internet access through Secure Connect. 
• Complete-capable regions provide a seamless, one-click process to auto-provision the enhanced  head-end and connect selected branches. These regions support both internet and private access for attached branches and remote workers with policy controls in the Cloud Firewall.

Plan Before You Start 

Before beginning the enrollment process, it is important to familiarize yourself with the following points:

• The Meraki SD-WAN branches enrolled in any Complete regions use the Secure Connect enhanced head-end.  Cloud Hubs are used for regions that are Foundation-only.
• The VPN-enabled subnets within the local networks of the branches will be announced to Secure Connect.
• Secure Connect will provide a default route (0.0.0.0/0) to the Meraki SPOKE sites linked to the enhanced cloud head-end.
• Cloud firewall will govern communication between the Meraki SD-WAN branch networks, Private Applications and Networks, and the Internet.
• For additional details, refer to document on  Manage Firewall Policies and Creating Access Policies for Private Applications and Networks.

Cloud On-Ramp

By using the described two options to enroll Meraki SD-WAN branches, users no longer need or have available the Cloud OnRamp method available under Organization > Configure > Cloud On-Ramp.

 

---

Connect Meraki SD-WAN Branches to Secure Connect Regions 

The Meraki SD-WAN branch sites use Auto VPN to connect to the Secure Connect fabric through an intermediate SD-WAN Traffic Acquisition region. Multiple Meraki SD-WAN branch sites can connect to a desired Secure Connect Region.

From the Sites page > click Connect Meraki Networks

 

Assign Meraki SD-WAN sites to Secure Connect regions — from the Add Sites > select the Unassigned Meraki SD-WAN branch sites > click Assign to Region > select a specific Secure Connect region to assign to the Meraki SD-WAN branch sites.

 

First select all the Meraki branch sites that are closest to Internet and Private App Access Regions which connects to the enhanced cloud head-end and then click on > the correspond Internet & Private App region. 

Click on > Next and then Finish & Save.

 

All selected networks (which includes both the networks connected to the Region with enhanced cloud headend and networks connecting to the Cloud Hubs) will move to the Assigned tab and all unselected networks will stay in the Unassigned tab.

Click on Next > Review the Sites that needs to be added to the selected Cloud Hub. Click on > Finish & Save.

 

 

---

Re-assign Meraki SD-WAN Sites to Different Regions 

After successfully connecting Meraki SD-WAN Sites to Secure Connect regions. Now, we have the flexibility to shift sites from one region to another based on their need and usecase.

Re-assigning a Site from one region to another is very simple, Go to Secure Connect > Identities & Connections > Sites and Select a Site or bulk select all the Sites that needs to be re-assigned and Click on > Change Region or Cloud Hub

Select the new region where we want to move a Site OR bulk of Sites.

 

---

Detaching a Site from a Region (Enhanced Head-End) or Cloud Hub

For any reason if there is a need to remove a particular Meraki SD-WAN site from Secure Connect, there is an option to detach a Site from Secure Connect.

Go to Secure Connect > Identities & Connections > Sites page. From the list of Meraki SD-WAN Sites Click on > The Site to be Detached > On the top right corner Select Detach Site from Secure Connect.

 

A window will pop up asking for a confirmation to detach the selected Site or Sites from Secure Connect. Upon confirming Sites will be detached.

 

---

Removing an entire Cloud Hub from Secure Connect 

If there is a need to remove an entire Cloud Hub (Internet Access only regions) from Secure Connect, then Go to Secure Connect > Identities & Connections > Sites > Click on > Configure Cloud Hub

A new window will pop up to Manage Cloud Hubs > From the list of Cloud Hubs find the Cloud Hub that needs to be deleted.

There will be … (dotted) line beside that Cloud Hub, Click On > The dotted line > Select Remove Cloud Hub

A confirmation window will pop up and after confirming, the Cloud Hub and its all associated Sites will be removed from Secure Connect.

---

Select Local Networks announced to Secure Connect 

1. From the Sites page > click on the site name (not a checkbox) to toggle the site panel details > Local networks > click Enable or disable Meraki network subnets link. This will open the Security & SD-WAN > Configure > Site-to-Site VPN page of the selected site.
2. From the Site-to-Site VPN configuration page of the site > VPN Settings > select VPN mode Enabled for the subnet(s) to be announced to Secure Connect via Auto VPN, and then click Save > Confirm Changes.

   For local networks which are not Enabled to participate in VPN, their default Internet traffic will be using the local upstream WAN connection of the site instead of sending the traffic to their configured Secure Connect region. In addition, those local networks are also not able to communicate with other Secure Connect sites and the Remote Access client.

   This step is to configure VPN Settings for the Meraki SD-WAN branch sites. Do NOT make any changes under the Site-to-Site VPN page of the connected Secure Connect region networks or Umbrella-SIG connector networks which are listed as the HUB networks in the Meraki dashboard as these will remove any currently configured Organization-wide settings > Non-Meraki VPN peers.

    

---