[TSHOOT] Troubleshoot Non-Meraki VPN Tunnels with Cisco Meraki MX Security Appliances

- Are you having issues creating a non-Meraki VPN tunnel with an MX?
- You do not know where the problem is?
- Do you want to understand the traffic flow of the VPN tunnel creation?
In this opportunity, we will go through the VPN settings, the expected behavior and the most common scenarios that you will encounter when you are having issues with a Non-Meraki VPN connection. This video will help you to have a complete understanding of the traffic between the Non-Meraki VPN peer and the MX Security Appliance as well as the event logs in order to understand in a fast and reliable way what is the root cause of your problem.
I encourage you to go through the whole video to examine the different scenarios including the last one with the expected traffic flow in a normal and healthy interaction.
Troubleshooting scenarios:
- Uni-directional traffic 1:37
- Phase 1 mismatch 6:54
- Preshared secret mismatch 11:54
- Phase 2 mismatch 15:00
- Private subnets mismatch 20:16
- Complete VPN tunnel 24:00
Additional videos:
- How to configure Non-Meraki VPN tunnel
• [HOW] to configure a N...
- Client VPN configuration
• [HOW] to configure Cli...
- Troubleshoot Client VPN
Cisco Meraki Documentation
- Site-to-Site VPN Settings
documentation.meraki.com/MX/S...
- Troubleshooting Non-Meraki Site-to-site VPN Peers
documentation.meraki.com/MX/S...
If you encounter any issues during the troubleshooting, feel free to post a comment with the information and I will help you to move forward.
If you would like to know more about similar topics, feel free to check the following videos:
- Content Filtering
• [HOW] to configure Con...
- Layer 3 and 7 Firewall Rules
• [HOW] to configure Lay...
- Client VPN
• [HOW] to configure Cli...
- Traffic shaping rules
• [HOW] to configure Tra...
- Wireless Settings
• [HOW] to configure Wir...
- Cisco Umbrella Integration
• [HOW] to integrate Cis...
- Flow Preferences
• [HOW] to configure Flo...
- Appliance Status Page
• Overview of the Applia...
- Creating VPN tunnels
• [HOW] to configure a N...
- DHCP configuration
• [HOW] to configure a D...
- Addressing and VLANs
• [HOW] to configure Add...

[@yayatichothe]

Today I ran into the issue with non meraki site to site VPN. I watched all your videos last week and was struggling fix the issue today before I ran in to this video of your posted 2 days back which helped identify and fix the VPN tunnel of our data center to client site. Thanks a lot and keep sharing the knowledge. Cheers!

[@TheITWay]

I am glad that you found it helpful. Let me know if you need any additional help!

[@deltafalcon1]

MAN... I really like your videos man.
Thank you for the content.

[@oakleyonline8218]

Thank you, I learned more than just how to configure a VPN, thank for breaking down the packet captures, greatly appreciated.

[@TheITWay]

Hello @Oakley,
I am happy that you found the videos useful. Stay tuned for more videos!

[@RodrigoNunes1110]

thank you for your time, it was very usefull
greetings from Brazil! :-)

[@TheITWay]

Thanks Rodrigo, I am glad you liked it!

[@ABedMAhfouz-tf4eh]

Excellent :)

[@user-xy4sh9jv4h]

Trying to VPN between MX64 and MX250 on different meraki sites. The only entry in the event log on the MX250 is: Non-Meraki VPN, Non-Meraki VPN negotiation,msg: FIPS mode disabled. Nothing on MX64. When they were both in the same site the automatic VPN worked fine.

[@dzulfiqaralghifari4694]

why do you have such a detail event log on your dashboard? I only have established IKE-SA event on my dashboard

[@jamzky6036]

Hello, I’m currently encountering an issue with our non-Meraki site-to-site VPN setup. For several months, we’ve enjoyed a consistent and stable connection to our remote site. However, starting last Thursday, the connection dropped unexpectedly. Strangely, the VPN status appears green and connected, but I’m unable to reach the other end’s local subnet, and vice versa. Upon inspecting the logs, I noticed an established tunnel connection, but the packet tracer indicates dropouts or retransmissions. I couldn't see from the event logs the negotiation phases as well. Already sent a ticket to Meraki support and since then they're still troubleshooting the issue. Hope you can provide some clarity/ advice on this? Appreciate you videos/content that you put up online. Have a good day!

[@MrMunenomura]

Hi, this is great video, and very helpful.
But I have an issue. I followed your video to create non Meraki peer, but it does not seem to start negotiating. No log is generated for "All Non Meraki / Client VPN". I have also pinged the destination, but still no luck. Is there anything else I need to do to start the IKE negotiation?

[@jamzky6036]

Question Sir, for the Phase 2 configuration is it better to be one encryption and 1 authentication. I am not really sure why in our organization, 4 encryptions are present (AES 256, AES192, AES128 and 3DES), and two on the authentication (SHA1 and MD5). and right now I am having trouble with the Non-meraki site to site vpn :D

[@romperstomper9371]

I have a meraki making a vpn against an ASA. the tunnel is up but some services don't work (sap, proxy), the ping responds in both directions but for some reason they don't work. Has anyone had this problem?

[@kencabigon3259]

Thanks man. That is very useful but I got this in my event log. Non-Meraki / Client VPN negotiation msg: no policy found: 10.10.60.0/24 (my local address) [0] 10.247.51.0/24 (my remote address) [0] proto=any dir=in. I don't know what happen

[@pacogarcia3365]

Hey nice video ! I'm sorry but where do you get all the materials to make your test, are some kind of millionaire ???

[@TheITWay]

Hello Paco,
Nothing at all, LOL.

[@ErsanYolcu]

All I get is msg: FIPS mode disabled, lol