VPN Concentrator Deployment Guide

Dashboard & Cloud

The MX WAN appliance is a cloud managed networking device. As such, it is important to ensure that the necessary firewall policies are in place to allow for monitoring and configuration via the Cisco Meraki Dashboard. The relevant destination ports and IP addresses can be found under the Help > Firewall info page in the Dashboard.

VPN Registry

Cisco Meraki's AutoVPN technology leverages a cloud-based registry service to orchestrate VPN connectivity. In order for successful AutoVPN connections to establish, the upstream firewall must allow the VPN concentrator to communicate with the VPN registry service. The relevant destination ports and IP addresses can be found under the Help > Firewall info page in the Dashboard.

Uplink Health Monitoring

The MX also performs periodic uplink health checks by reaching out to well-known Internet destinations using common protocols. The full behavior is outlined here. In order to allow for proper uplink monitoring, the following communications must also be allowed:

• ICMP to 8.8.8.8 (Google's public DNS service)

• HTTP port 80

• DNS to the MX's configured DNS server(s)

Example Topology

An MX VPN concentrator can also be configured to operate in Routed mode. The following diagram shows an example of a datacenter topology with a Routed mode concentrator:

Interface Configuration 

The MX WAN appliance being configured as a VPN concentrator should be connected to the "upstream" datacenter infrastructure closer to the network edge using its Internet port, and connected to "downstream" infrastructure closer to the datacenter services using a LAN port.

Dashboard Configuration

The Cisco Meraki Dashboard configuration can be done either before or after bringing the unit online.

The following configuration steps will be covered in more detail in the sections below:

1. Configure the MX to operate in Routed mode.

2. Define VLANs and static routes.

3. Configure the Site-to-Site VPN parameters.

Other Datacenter Configuration

Routing Considerations

The MX acting as a VPN concentrator in the datacenter will be terminating remote subnets into the datacenter. In order for bi-directional communication to take place, the downstream network must have routes for the remote AutoVPN subnets that point back to the MX acting as the VPN concentrator.

In order for traffic received on the LAN side of a Routed mode concentrator to be passed over AutoVPN, traffic must both be sourced from a subnet matching a local VLAN or static route defined on the Addressing & VLANs page of the concentrator and that subnet must be allowed in VPN. If either condition is not met, traffic will not be routed by the MX from the LAN over AutoVPN.

Upstream Considerations

This section discusses configuration considerations for other components of the datacenter network.

Appendix 1: One-armed concentrator operation

A WAN appliance operating in one-armed concentrator mode sends and receives traffic on a singular interface. This interface will always be the the first Internet or WAN port on the unit. A secondary port is not supported when deployed as a VPN concentrator.

It is important to understand the flow of traffic sent across an AutoVPN tunnel while the MX is acting as a one-armed concentrator. In the following scenario we have a host at a branch location trying to load a webpage located in the datacenter, over the site-to-site VPN.

1. The client sends traffic to the private address of the web server to its default gateway, the MX (in Routed mode) at the branch location.

2. The branch MX will look at its routing table and see that the destination IP address is contained within a subnet that is accessible over the Meraki AutoVPN.

3. The branch MX encrypts and encapsulates the data from the client and sends a packet source from its WAN interface, destined for the public IP address and port of the one-armed concentrator at the datacenter that was learned through the VPN registry.

4. This traffic is routed across the Internet to the edge of the datacenter.

5. The edge of the datacenter will NAT the traffic into a private address and send the traffic to the IP address of the one-armed concentrator.

6. The traffic will traverse the network internal to the datacenter and arrive at the one-armed concentrator. The MX will then decrypt and de-encapsulate the traffic and forward the original packet (sent by the client from the branch) upstream.

7. The upstream datacenter infrastructure routes traffic to the server.

8. The server receives the client traffic and sends a response to the client.

9. The response is then routed back through the internal datacenter network to the MX acting as a one-armed concentrator.

10. Upon receiving this response, the one-armed concentrator sees that the destination IP address is contained within a subnet that is accessible over the site-to-site VPN, looks up the contact information for the corresponding AutoVPN peer, encapsulates and encrypts the data, and sends the response on the wire.

11. The response, destined for the public IP and AutoVPN port of the branch MX, is then routed through the datacenter and NAT’ed out to the Internet.

12. The packet is then routed through the Internet to the branch MX.

13. The Branch MX receives the response, decrypts, de-encapsulates, and forwards the server's response downstream.

14. The response then traverses the internal branch network and is received by the client device.

Appendix 2: Routed mode concentrator operation

A WAN appliance operating as a Routed mode concentrator sends and receives encapsulated and encrypted traffic on its WAN interface and sends and receives de-encapsulated and decrypted traffic on its LAN interface.

It is important to understand the flow of traffic sent across an AutoVPN tunnel while the MX is acting as a Routed mode concentrator. In the following scenario we have a host at a branch location trying to load a webpage located in the datacenter, over the site-to-site VPN.

1. The client sends traffic to the private address of the web server to its default gateway, the MX (in Routed mode) at the branch location.

2. The branch MX will look at its routing table and see that the destination IP address is contained within a subnet subnet that is accessible over the Meraki AutoVPN.

3. The branch MX encrypts and encapsulates the data from the client and sends a packet source from its WAN interface, destined for the public IP address and port of the Routed mode concentrator at the datacenter that was learned through the VPN registry.

4. This traffic is routed across the Internet to the edge of the datacenter.

5. The edge of the datacenter will NAT the traffic into a private address and send the traffic to the IP address of the Routed mode concentrator.

6. The traffic will traverse the network internal to the datacenter and arrive at the Routed mode concentrator's WAN interface. The MX will then decrypt and de-encapsulate the traffic.

7. The concentrator will look at its routing table and forward the original packet (sent by the client from the branch) downstream based on the most specific route to the destination address.

8. The downstream datacenter infrastructure routes traffic to the server.

9. The server receives the client traffic and sends a response to the client.

10. The response is then routed back through the internal datacenter network to the MX acting as a Routed mode concentrator.

11. Upon receiving this response, the Routed mode concentrator sees that the destination IP address is contained within a subnet that is accessible over the site-to-site VPN, looks up the contact information for the corresponding AutoVPN peer, encapsulates and encrypts the data, and sends the response on the wire out its WAN interface.

12. The response, destined for the public IP and AutoVPN port of the branch MX, is then routed through the datacenter and NAT’ed out to the Internet.

13. The packet is then routed through the Internet to the branch MX.

14. The Branch MX receives the response, decrypts, de-encapsulates, and forwards the server's response downstream.

15. The response then traverses the internal branch network and is received by the client device.