Overview 

Organizations are shifting their network landscape by moving all on-prem applications to the public or private cloud. Previously all traffic was back-hauled through data centers, but now almost 80% of traffic is routed directly to the internet. Securing a network edge has always been complex and with this change in network infrastructure, it became even more difficult to manage and secure an entire organization.

Cisco Secure Connect Foundation is the unified SASE journey that customers can adopt for integrating their Meraki SD-WAN with cloud-based security stack powered by Cisco Umbrella. This deployment guide outlines how to establish an Auto VPN based integration of your Meraki MX Security and SD-WAN appliance to Secure Connect’s security cloud. Secure Connect provides a unified management of security and network infrastructure from a single pane of glass Secure Connect Dashboard, so that network administrators do not have to separately manage security settings for each SD-WAN branch. All Internet-bound traffic will be forwarded to Secure Connect fabric and protected by the Umbrella SIG stack through an Auto VPN tunnel to our nextgen SD-WAN traffic acquisition headend inside Secure Connect cloud for inspection and filtering.

Use Case 

• Inspect all internet-bound traffic at scale from a single cloud-delivered platform.
• Managing and monitoring both network devices and their security policies from simple cloud-based solution and a single dashboard.
• Network administrators want to manage the entire set of security policies for all SD-WAN branches using a single pane of glass.
• Organizations want to exclude guest traffic or high bandwidth application traffic from cloud security services.
• Organizations want to utilize a unified cloud-based security solution without incurring additional costs from interconnecting it to their existing Meraki network solution.
• Organizations want to securely interconnect their SD-WAN branches and manage them through a unified cloud-based solution.
• Organizations want to be able to dynamically scale and manage their network infrastructure through a robust SASE solution.

Licensing

Secure Connect offers the Foundation license for customers looking to secure their Meraki SD-WAN branch to internet and securely interconnect their SD-WAN branch to branch traffic through Secure Connect cloud. There are 2 options with Secure Connect Foundation license:

1.     Secure Connect Foundation Essentials (includes Meraki dashboard, Umbrella SIG Essentials capabilities and secure Branch to Branch Interconnect)

2.     Secure Connect Foundation Advantage (includes Meraki dashboard, Umbrella SIG Advantage capabilities and secure Branch to Branch Interconnect)

Onboarding - Getting your Secure Connect Dashboard 

To begin, you'll first need to integrate Meraki and Cisco Umbrella management together for a seamless experience.  For further instructions, see Cisco Secure Connect Onboarding.

After successfully onboarding your organization to Secure Connect, to connect your remote users please follow the remote user setup guide.

Data Center Availability

Since we are introducing both internet access and secure branch to branch interconnect capabilities with Secure Connect, there will be a progressive data center availability for the secure SD-WAN branch to branch interconnect. Following table show the data center availability based on Internet Access and Private (secure branch-to-branch) access capabilities:

Connecting Meraki SD-WAN Sites to Secure Connect

After successfully onboarding Secure Connect to your Meraki dashboard. Its super simple and automated to integrate your Meraki SD-WAN networks to Secure Connect fabric.

Click on Secure Connect > Identities & Connections > Sites.

There are multiple usecases based on the current stage of your integration of Meraki SD-WAN with Secure Connect. Following are the different onboarding flows according to a usecase, feel free to jump to the usecase that best describes your stage of onboarding:

Re-assign Meraki SD-WAN Sites to Different Regions

After successfully connecting Meraki SD-WAN Sites to Secure Connect regions. Now, we have the flexibility to shift sites from one region to another based on their need and usecase.

Re-assigning a Site from one region to another is very simple, Go to Secure Connect > Identities & Connections > Sites and Select a Site or bulk select all the Sites that needs to be re-assigned and Click on > Change Region or Cloud Hub

Select the new region where we want to move a Site OR bulk of Sites.

Removing a Site from a Region or Cloud Hub (Detaching a Site from Secure Connect)

For any reason if there is a need to remove a particular Meraki SD-WAN site from Secure Connect, there is an option to detach a Site from Secure Connect.

Go to Secure Connect > Identities & Connections > Sites page. From the list of Meraki SD-WAN Sites Click on > The Site to be Detached > On the top right corner Select Detach Site from Secure Connect.

A window will pop up asking for a confirmation to detach the selected Site or Sites from Secure Connect. Upon confirming Sites will be detached.

Removing an entire Cloud Hub from Secure Connect

If there is a need to remove an entire Cloud Hub from Secure Connect, then Go to Secure Connect > Identities & Connections > Sites > Click on > Configure Cloud Hub

A new window will pop up to Manage Cloud Hubs > From the list of Cloud Hubs find the Cloud Hub that needs to be deleted.

There will be … (dotted) line beside that Cloud Hub, Click On > The dotted line > Select Remove Cloud Hub

A confirmation window will pop up and after confirming, the Cloud Hub and its all associated Sites will be removed from Secure Connect.