vMX Setup Guide for Google Cloud Platform (GCP)

Overview

This document is a walkthrough for setting up a virtual MX appliance in the Google Cloud Marketplace. After completing the steps outlined in this document, you will have a virtual MX appliance running in Google Cloud that serves as an AutoVPN termination point for your physical MX devices.

Supported Instance Type and Regions

The vMX is currently only supported on the c2-standard-4 compute optimized instance type for optimal performance.  The C2 instance types are not available in all GCP regions.  Please refer to this document for the regions that support the C2 instances.

Meraki Dashboard Configuration 

Begin by creating a new Security Appliance network in your organization. If needed, please refer to the guide on creating a new network in the Meraki dashboard.

1. Add license(s) to the Meraki dashboard

To complete the vMX Meraki dashboard configuration, a vMX license must be available for use in your organization.

If your organization has already reached its vMX license limit, you will be unable to create new vMX networks until a vMX network is deleted or additional vMX licensing added.

If you do not have access to a vMX license or require additional vMX licenses, please reach out to your Meraki reseller or sales representative.

2. Create a "Security appliance" network type: 

3. Assign vMX type to network

Once you have created the "Security appliance" network and added the appropriate license you will be able to deploy a new vMX to your network by clicking on the 'Add vMX' button.

4. Generate the authentication token

After you add the new vMX to your network, navigate to Security & SD-WAN > Monitor > Appliance status and select “Generate authentication token” to generate the token for the GCP vMX Authentication Token field.

5. Copy the newly generated token and save it.

The newly generated token will be used in the "New Cisco Meraki vMX deployment" configuration section when creating a new instance.

Google Cloud Setup 

Before You Begin

You must have the following before you begin:

• Google Cloud VPC network. To find more information about this, please click here.

Deploying the vMX

Deploying the vMX can be done by following the steps below:

1. Access the Cisco Meraki vMX offer by clicking here or search for "Meraki" in the GCP marketplace to find the vMX solution
2. Click Launch on the vMX offer landing page       
3. Enter a Deployment Name for the instance
4. Choose the desired Zone
5. Select the c2-standard-4 vMX instance size.  This is the only instance size currently offered for vMX on GCP 
6. Paste the vMX Authentication token you copied from the Meraki dashboard in the steps earlier to the vMX Authentication Token field
7. The Boot Disk options can remain as-is
8.  Under the Network section select the desired Network, Subnetwork and External IP for this instance.  The External IP field can be left as Ephemeral (if you would like to let GCP assign a public IP to the vMX itself) or set to None (if you would like to have a private IP on the vMX and have it egress through an upstream device like a firewall or Google Cloud NAT instance).  You do not need to add more network interfaces to the VM as it is a single interface appliance
9. Click Deploy

gcloud compute instances create VMX_INSTANCE_NAME \
    --zone=ZONE \
    --image=meraki-vmx-16-10 \
    --image-project=cisco-public \
    --network-interface=nic-type=GVNIC,network=NETWORK,subnet=SUBNET \
    --machine-type=c2-standard-4 \
    --tags=http-server \
    --can-ip-forward \
    --enable-display-device \
    --metadata=token=VM_AUTH_TOKEN

Additional VPC Configuration

The virtual MX appliance will allow for site-to-site VPN connectivity using Auto VPN between GCP and other remote MXs. In order to have proper bidirectional communication between remote subnets that are terminating into GCP via the vMX and hosts within GCP, the VPC routing table must be updated for the remote Auto VPN-connected subnets.

1. Navigate to VPC Networks > Routes from the GCP console and select Create Route.  
2. Specify a Name and Description for the route.
3. Select the Network that your vMX is deployed in. 
4. In the Destination IP range, add the routes available via Auto VPN.
5. Select the Specify an instance option for the next hop and select the vMX instance as the Next hop instance.  

We can also leverage the BGP capabilities on the vMX to exchange routes dynamically between the vMX and GCP. Please, refer to the vMX integration guide with Google's Network Connectivity Center for more details.  

Known Limitations

Troubleshooting 

Key Concepts

Before deploying a virtual MX, it is important to understand several key concepts: