[TSHOOT] Troubleshoot AutoVPN and VPN Registry in Cisco Meraki MX Security Appliances

- Are you having issues creating an AutoVPN tunnel with the MX?
- You do not know where the problem is?
- Do you want to understand the traffic flow of the AutoVPN tunnel creation?
- Do you want to understand how VPN Registries work?
_______________________________________________________________________________________
Cisco Meraki Training
• Cisco Meraki training:...
_______________________________________________________________________________________
In this opportunity, we will go through the AutoVPN settings, the expected behavior and the most common scenarios that you will encounter when you are having issues with an AutoVPN connection. This video will help you to have a complete understanding of the traffic between the VPN peers and the VPN Registry as well as the event logs in order to understand in a fast and reliable way what is the root cause of your problem.
I encourage you to go through the whole video to examine the different scenarios including the last one with the expected traffic flow in a normal and healthy interaction.
Troubleshooting scenarios
- AutoVPN Overview 1:58
- Uni-directional traffic 6:09
- VPN Registry: Disconnected 15:02
- VPN Registry: Partial connected 19:55
- Expected AutoVPN traffic 23:25
________________________________________________________________________________________
Additional videos
- VPN Configuration
• [HOW] to configure a N...
- ClientVPN Configuration
• [HOW] to configure Cli...
- Troubleshooting client VPN
• [TSHOOT] Troubleshot C...
- Troubleshooting Non-Meraki VPN tunnel
• [TSHOOT] Troubleshoot ...
_________________________________________________________________________________________
Cisco Meraki documentation
- Site-to-Site VPN Settings
documentation.meraki.com/MX/S...
- Meraki AutoVPN
documentation.meraki.com/MX/S...
- Troubleshooting VPN Registry
documentation.meraki.com/MX/S...
If you encounter any issues during the troubleshooting, feel free to post a comment with the information and I will help you to move forward.
________________________________________________________________________________________
If you would like to know more about similar topics, feel free to check the following videos:
- Content Filtering
• [HOW] to configure Con...
- Layer 3 and 7 Firewall Rules
• [HOW] to configure Lay...
- Client VPN
• [HOW] to configure Cli...
- Traffic shaping rules
• [HOW] to configure Tra...
- Wireless Settings
• [HOW] to configure Wir...
- Cisco Umbrella Integration
• [HOW] to integrate Cis...
- Flow Preferences
• [HOW] to configure Flo...
- Appliance Status Page
• Overview of the Applia...
- Creating VPN tunnels
• [HOW] to configure a N...
- DHCP configuration
• [HOW] to configure a D...
- Addressing and VLANs
• [HOW] to configure Add...

[@jamirsayyad1473]

Great session ... Keep it up

[@elijahbrylleflorenosos6098]

hi sir, can you create a tutorial on vpn concentrator mode and why do we need it

[@laborielkain1748]

Hello. My CISCO MX84 NAT Status is showing as NONE instead of FRIENDLY. Can you please explain further on the cause?

[@deltafalcon1]

I appreciate your content.

[@TheITWay]

Thanks deltafalcon1

[@ejg398]

Hey Joan. It has been years since I have messed with Cisco gear. I was recently asked to help get some Z3s connected to a MX67 behind an ASA due to covid19 and having remote workers. I have the Site to Site VPN established but I cannot get the traffic to communicate from the teleworker to the internal network. What am I missing?

[@TheITWay]

Hello Juan,
Most of the time this behavior is because some firewall rules put in place before this new implementation, since you are adding new subnets coming from these Z3s, the old firewall rules might not allow these new traffic.
The best way to find that out is taking packet captures. If you are saying that the VPN tunnel is established, the hard part is already done, this is what you can do:
- Send continuous pings form the Z3s to the internal resources and take pcaps in the VPN tunnel of both devices and the LAN side of the MX67.
+ If you see the ping requests in the LAN side of the MX67, it means that the traffic is passing through and the VPN tunnel is good. If you do not see the ping reply coming from the internal network, it means that something in the network is blocking that traffic and the MX67 is not receiving the replies.
If that is the case, your work should be focused on taking pcaps in that network and follow the traffic to understand which device is blocking the traffic or if the device itself is nor replying to the pings ( probably because of the firewall reasons I mentioned earlier) .
This is a common behavior when new VPN tunnels are established in previous infrastructures. I hope that helps you.

[@CV-rw6os]

How about friend, I want to ask you a question
I have two MX100s that will work in hub mode and I have 10 Z3C gateways and I want to set up VPN Site to Site.
What is the correct mode: the two MX in Hub mode and the ten Z3C in spoke mode?
Thanks for your help and if you could explain the difference between hub and spoke, I would appreciate it.

[@TheITWay]

Hello @Carlos,
The selection of the Hub or Spoke will depend on the expected flow of the traffic. If you need a concentrated place where the major traffic will flow ( i.e. a data center or HQ) you would want to configure that place as a Hub and everyone that needs to reach out to that resource as a Spoke. However, this can change depending on your needs. You can use an additional Hub for redundancy.
If you would like to know more about the Hub-Spoke implementation, you can read the documentation below.
documentation.meraki.com/Architectures_and_Best_Practices/Auto_VPN_Hub_Deployment_Recommendations
documentation.meraki.com/MX/Deployment_Guides/Datacenter_Redundancy_(DC-DC_Failover)_Deployment_Guide

[@MdAnwarHossain]

brother i am waiting for the tutorial to stop dhcp snooping attack in meraki switch and utm

[@StyleDirty]

Hi from France, thank you very much for this very useful TShoot
But what if ramdomly every 2-3 days the VPN goes down at once, and will not come up until MS rebooted ?

[@TheITWay]

Hello Bad Style,
If that is the case, you have to troubleshoot live while the issue is current and go through the video taking the pcaps to understand which part is the one with the problem and analyze how to fix it. All the should be done before rebooting it.

[@user-pn3pe9xk9x]

Hi sir, Is there firewall rules that can block site to site vpn? In the packet capturer I just see my ip trying to communicate on phase 1 but phase1 negotiation failed due to time up. 5b22f67af7ff7a0f:0000000000000000

[@nishantpandey8799]

From single IP 2 MX can come online ??

[@andyhockett2625]

I'm having an issue with Nat type Unfriendly? What is the fix?

[@TheITWay]

Hello @Andy
Most of the times that you have NAT Type unfriendly is related to the upstream NAT device you have. It is because it is not honouring either the ports the MX is using or it is changing the public IP address when the traffic goes to the VPN registry or the VPN tunnel.
Points to consider:
- Ensure that the traffic sent to the VPN registry is not altered by the NAT device ( source and destination port)
- Ensure the traffic sent to the other VPN peer is not altered by the NAT device ( same source port and source public IP address as the traffic to the VPN registry)
I would recommend you to take packet captures in the Internet interface of the MX and the internet interface of the NAT device to confirm what was mentioned above.
If this traffic is different, you will have that message. The documentation below will help you to understand better the behaviour and provide guidelines in how to fix it from your NAT device. Ultimately, it is not something that have to be addresses upstream.
documentation.meraki.com/MX/Site-to-site_VPN/Troubleshooting_VPN_Registration_for_Meraki_Auto_VPN#NAT_Type:_Unfriendly

[@sabyasachibhattacharya4980]

You mean to say no issue with Meraki. Its always out side hmm