Cisco Secure Connect - Non-Meraki IPSec Tunnel

Multiple Tunnels

Each manual IPSec tunnel is limited to 250 Mbps down and 80 Mbps up bandwidth, as documented in Umbrella User Guide. To achieve higher throughput, we can establish multiple tunnels. Creating multiple tunnels from the same device. For more details, see examples in Multiple Tunnels Load Sharing and Can-I-create-multiple-IPSEC-Tunnels.

If you set up multiple tunnels, there are limitations to follow:

1. A unique set of Network Tunnel credentials must be used for each IPSec tunnel. Two IPSec tunnels cannot connect to the same data center with the same credentials (IP addresses) at the same time. Using 2 different public IP addresses on the customer device, or two different loopback addresses that are NATed using different port numbers will activate the both tunnels at the same time. Example how to accomplish this can be found here.
2. For Secure Internet Access, all traffic should be initiated from behind the IPSec tunnel. We recommend that you divide the traffic between the tunnels either through load balancing with ECMP (Equal-cost multi-path routing) or assigning traffic through policy-based routing. Overlapping IPs in Edge devices is supported and ECMP is supported only if tunnels are terminating at the same Data Center headend. This configuration is done on customer device if supported. 
3. For Secure Private Access, remote access users or branch users will be initiating traffic toward the servers behind the IPSec tunnel. Overlapping IPs is not recommended as it can cause unexpected behaviour with routing.

5. In the upper right hand corner of the screen, click Return TO SECURE CONNECT.

Accessing Tunnel Edit Options

1. From the Meraki Secure Connect dashboard, navigate to the Secure Connect menu > Identities & Connections > click on the Network Tunnel link. The page will be redirected to the Umbrella dashboard where you can configure the Deployments > Core Identities > Network Tunnels.
   
2. From the Network Tunnels page > click on the horizontal ellipsis button (. . .) next to the private tunnel that you would like to make the change > and then click Details.
   
3. Within the Network Tunnels details page > click on the horizontal ellipsis button (. . .) > and then click Edit to show the Tunnel Edit options. 
   

   The following are the available tunnel settings that can be modified:

   • Tunnel Name
   • Tunnel ID
   • Passphrase
   • Client Reachable Prefixes

   

Update Tunnel ID

From the Network Tunnel edit options > click Edit under the Tunnel ID to access the Update Tunnel ID popup window > enter New Tunnel ID name > click the acknowledgment checkbox > and then click Save​​​​​.

Update Tunnel Passphrase

From the Network Tunnel edit options > click Edit under the Passphrase to access the Update Tunnel Passphrase popup window > enter New Passphrase and Confirm Passphrase > click the acknowledgment checkbox > and then click Save​​​​.

Edit Client Reachable Prefixes

From the Network Tunnel edit options > click Edit under the Client Reachable Prefixes to access the Edit Client Reachable Prefixes popup window > enter the IP ranges and CIDR addresses that remote users need to access via the IPSec tunnel > click on the checkbox to Acknowledge Disconnect & Reconnect Requirement > and then click Save.