Meraki’s hub and spoke model very closely resembles a traditional hub and spoke model, where any device configured as a hub will attempt to establish a direct VPN tunnel and learn/advertise any available routes between itself and all other hubs and any assigned spokes. Likewise, a site configured as a spoke will only form tunnels and learn/advertise routes to the configured hub(s).
This model allows for a great amount of flexibility, because each site can be configured as either a hub or spoke in the topology depending on the need. Whether configuring your VPN topology as a full mesh by configuring all sites as hubs, as a traditional hub and spoke model, or as something in between, the Meraki Auto VPN solution makes configuration and deployment simple and easy.
NAT Traversal
When you’re configuring an Auto VPN topology, it’s important for each site to have the proper NAT traversal configuration. By default, all Meraki sites use automatic NAT traversal, which employs UDP hole punching in addition to the automatic negotiation of connection details through the cloud-hosted VPN registry to allow sites to quickly and easily bring up a VPN connection.
For sites that are located behind an unfriendly upstream NAT, such as Carrier-Grade NAT (CGNAT) used by cellular carriers, or that otherwise require a specific port be manually specified, the VPN Settings section of the Site-to-Site VPN page has a NAT Traversal option that you can set to Manual (see Figure 5-12), which enables you to configure a static public port to be used for all VPN-related communication for the MX contained in that network.
Figure 5-12 NAT Traversal Configuration on the Site-to-Site VPN Page in the Dashboard
More detailed information on how to set up and operate Meraki Auto VPN, visit https://documentation.meraki.com and view the article “Automatic NAT Traversal for Auto VPN Tunneling Between Cisco Meraki Peers.”
Hub and Spoke Recommendations
There are many recommendations and best practices covering VPN deployments that may be applicable based on your specific deployment needs. However, due to the varied needs of different deployments, including scale and hardware selection, this section covers only some basic recommendations to help point you in the right direction during your deployment.
You can find more detailed information on best practices for specific use cases at https://documentation.meraki.com or by reaching out to the Meraki sales organization or your existing Meraki account team.