Meraki’s hub and spoke model very closely resembles a traditional hub and spoke model, where any device configured as a hub will attempt to establish a direct VPN tunnel and learn/advertise any available routes between itself and all other hubs and any assigned spokes. Likewise, a site configured as a spoke will only form tunnels and learn/advertise routes to the configured hub(s).

This model allows for a great amount of flexibility, because each site can be configured as either a hub or spoke in the topology depending on the need. Whether configuring your VPN topology as a full mesh by configuring all sites as hubs, as a traditional hub and spoke model, or as something in between, the Meraki Auto VPN solution makes configuration and deployment simple and easy.

NAT Traversal

When you’re configuring an Auto VPN topology, it’s important for each site to have the proper NAT traversal configuration. By default, all Meraki sites use automatic NAT traversal, which employs UDP hole punching in addition to the automatic negotiation of connection details through the cloud-hosted VPN registry to allow sites to quickly and easily bring up a VPN connection.

For sites that are located behind an unfriendly upstream NAT, such as Carrier-Grade NAT (CGNAT) used by cellular carriers, or that otherwise require a specific port be manually specified, the VPN Settings section of the Site-to-Site VPN page has a NAT Traversal option that you can set to Manual (see Figure 5-12), which enables you to configure a static public port to be used for all VPN-related communication for the MX contained in that network.

Figure 5-12 NAT Traversal Configuration on the Site-to-Site VPN Page in the Dashboard

More detailed information on how to set up and operate Meraki Auto VPN, visit https://documentation.meraki.com and view the article “Automatic NAT Traversal for Auto VPN Tunneling Between Cisco Meraki Peers.”

Hub and Spoke Recommendations

There are many recommendations and best practices covering VPN deployments that may be applicable based on your specific deployment needs. However, due to the varied needs of different deployments, including scale and hardware selection, this section covers only some basic recommendations to help point you in the right direction during your deployment.

You can find more detailed information on best practices for specific use cases at https://documentation.meraki.com or by reaching out to the Meraki sales organization or your existing Meraki account team.

Leave a Reply

Your email address will not be published. Required fields are marked *

Explore More

SNMP – Automating the Dashboard – Cisco Meraki

SNMP is also a potential option that can be employed for automation with any Meraki platform. One notable difference between SNMP and webhooks or syslog is that when using SNMP,

Automated API-based Organization Status – Automating the Dashboard – Cisco Meraki

To start, you need to determine the organization IDs for the organization you want to monitor. You can do so by sending a GET request to the endpoint as shown

Client VPN – MX and MG Best Practices – Cisco Meraki

In addition to the revolutionary Auto VPN solution, Meraki MX security appliances also offer the option for a direct L2TP/IPsec VPN connection for remote clients, referred to as Client VPN.