Meraki AutoVPN technology is a unique solution that allows site-to-site VPN tunnel creation with a single mouse click. When enabled through the Dashboard, each participating MX/Z1 device automatically does the following:
The net result is an automatic mesh site-to-site VPN solution that is configured with a single click.
Site-to-site VPN settings are accessible through the Security Appliance > Configure > Site-to-site VPN page.
There are three options for configuring the MX/Z1's role in the AutoVPN topology:
There are two tunneling modes available for MX/Z1 appliances configured as a Spoke:
When an appliance is configured as a Spoke and is set to Split tunneling, multiple VPN hubs can be configured for that appliance. In this configuration, the Spoke MX will send all site-to-site traffic to its configured VPN hubs.
To add additional hubs, click the "Add another hub" button just below the existing hub that is selected. Please note that only appliances in Mesh VPN mode can be hubs, so the number of Mesh VPN appliances in your Dashboard organization represents the maximum number of hubs that can be configured for any given appliance.
The order in which hubs are configured on this page is the hub priority. Hub priority is used to determine which hub to use if more than one VPN hub is advertising the same subnet. The uppermost hub that is a) advertising the subnet and b) currently reachable via VPN will be used to reach that subnet.
Hubs can be deleted by clicking on the grey "X" to the right of the relevant hub. The hub priority list can be reordered by clicking and dragging the grey four-point arrow icon to the right of any hub in the list to move that hub up or down.
This option is only available if Full tunneling is configured for a Spoke MX, or if the MX is configured as a Hub. This option lets you designate the remote MX device that is to receive all network traffic from the local MX device.
The concentrator priority determines how appliances in Hub (Mesh) mode will reach subnets that are advertised from more than one Meraki VPN peer. Similarly to hub priorities, the uppermost concentrator in the list that is a) advertising the subnet and b) currently reachable via VPN will be used for such a subnet. It is important to note that concentrator priorities are used only by appliances in Mesh mode. An appliance in Hub-and-Spoke mode will ignore the concentrator priorities and will use its hub priorities instead.
If the MX appliance is behind a firewall or other NAT device, there are two options for establishing the VPN tunnel:
If you have multiple LAN subnets, you have the option to specify which VLANs and static routes participate in the VPN.
The same subnet can only be advertised from more than one appliance if all appliances advertising that subnet are in Passthrough or VPN Concentrator mode. All subnets advertised from an appliance in NAT mode must be unique within the AutoVPN topology.
In large distributed networks, multiple networks may have identical subnet scopes (i.e. overlapping subnets). Site-to-site VPN communication requires each site to have distinct and non-overlapping local subnets. In the event that multiple locations have the same local subnet, enable VPN subnet translation to translate the local subnet to a new subnet with the same number of addresses.
While the MX Security Appliance does not currently support full OSPF routing, OSPF can be used to advertise remote VPN subnets to a core switch or other routing device, avoiding the need to create static routes to those subnets. OSPF advertisement is only supported in VPN Concentrator mode.
Advertise remote routes: If this is set to Enabled, OSPF will be used to advertise remote VPN subnets as reachable via this concentrator.
Router ID: The OSPF Router ID that this concentrator will use to identify itself to neighbors
Area ID: The OSPF Area ID that this concentrator will use when sending route advertisements.
Cost: The route cost attached to all OSPF routes advertised from this concentrator.
Hello timer: How frequently the concentrator will send OSPF Hello packets. This should be the same across all devices in your OSPF topology.
Dead timer: How long the concentrator will wait to see Hello packets from a particular OSPF neighbor before considering that neighbor inactive
MD5 Authentication: If this is enabled, MD5 hashing will be used to authenticate potential OSPF neighbors. This ensures that no unauthorized devices are injecting OSPF routes into the network.
Authentication Key: The MD5 key number and passphrase. Both of these values must match between any devices that you wish to form an OSPF adjacency.
You can create Site-to-site VPN tunnels between the MX appliance and a Non-Meraki VPN endpoint device under the Non-Meraki VPN peers section in Security Appliance > Configure > Site-to-site VPN page. Simply click "Add a peer" and enter the following information:
There are three preset IPsec policies available.
If none of these presets are appropriate, the Custom option allows you to manually configure the IPsec policy parameters. These parameters are divided into Phase 1 and Phase 2.
By default, a non-Meraki peer configuration applies to all MX or Z1 appliances in your Dashboard Organization. Since is not always desirable for every appliance you control to form tunnels to a particular non-Meraki peer, the Availability column allows you to control which appliances within your Organization will connect to each peer. This control is based on network tags, which are labels you can apply to your Dashboard networks.
When "All networks" is selected for a peer, all MX and Z1 appliances in the organization will connect to that peer. When a specific network tag or set of tags is selected, only networks that have one or more of the specified tags will connect to that peer.
More information on network tags can be found here.
You can add firewall rules to control what traffic is allowed to pass through the VPN tunnel. These rules will apply to outbound VPN traffic from all MX appliances in the Organization that participate in site-to-site VPN. They will not apply to inbound traffic or to traffic that is not passing through the VPN. To create a firewall rule, click Add a rule in the Site-to-site firewall section on the Security Appliance > Configure > Site-to-site VPN page. These rules are configured in the same manner as the Layer 3 firewall rules described on the Firewall Settings page of this documentation.
You can monitor the status of the site-to-VPN tunnels between your Meraki devices by clicking Security Appliance > Monitor > VPN Status. This page provides real-time status for the configured Meraki site-to-site VPN tunnels. It lists the subnet(s) being exported over the VPN, connectivity information between the MX appliance and the Meraki VPN registry, NAT Traversal information, and the encryption type being used for all tunnels. Additionally, the Site connectivity list provides the following information for remote Meraki VPN peers:
This page displays limited information for non-Meraki peers.
Refer to Site-to-site VPN Troubleshooting for common issues and troubleshooting steps.