site to site vpn connection troubles with Azure

Sharyn Schmidt 241

Hi.

I am trying to set up a site to site vpn tunnel with a cisco meraki and an Azure Virtual Gateway. Everything seems to be configured on both the azure side and the meraki side but the tunnel won't connect.

I have configured a virtual network gateway in azure. I have configured a local network gateway for the remote site. I have made the meraki configurations for the site to site tunnel. I have added the connection to the network gate on the connections screen. All I get on the connections screen is "not connected"

The tunnel is not connecting. It is impossible to create a trouble ticket, all choices lead to this board. Is there anyone who would be willing to help me with this or anyone from azure on this board that can take pity on me?

Thanks in advance. The irony is, I have followed the documentation both from the azure side and the meraki side. I h

Sharyn Schmidt 241 Reputation points

2024-03-14T12:49:59.58+00:00

When I try to open a support ticket all I get is the AI asking me questions, then telling me to check with the Azure community or look at the documentation. There is no option to call or open a ticket link.
KapilAnanth-MSFT 35,416 Reputation points Microsoft Employee

2024-03-14T13:51:45.5866667+00:00

@Sharyn Schmidt ,

Can you pelase share a screenshot?

I am afraid you are missing a "X" or "Close" button to get back to support ticket creation.

Cheers,

Kapil
Sharyn Schmidt 241 Reputation points

2024-03-14T13:58:22.3933333+00:00
Sharyn Schmidt 241 Reputation points

2024-03-14T13:59:19.3066667+00:00

See my screenshot
Sharyn Schmidt 241 Reputation points

2024-03-14T14:00:41.2366667+00:00
KapilAnanth-MSFT 35,416 Reputation points Microsoft Employee

2024-03-14T14:01:19.5633333+00:00

@Sharyn Schmidt ,

Please share the entire window.

Cheers,

Kapil
KapilAnanth-MSFT 35,416 Reputation points Microsoft Employee

2024-03-15T13:45:17.2233333+00:00

@Sharyn Schmidt ,

You are most welcome.

Glad you were able to open the Support Incident.

Please keep the thread updated once you have the resolution

Cheers,

Kapil
Sharyn Schmidt 241 Reputation points

2024-03-18T15:05:25.93+00:00

I spoke with a tech last week who advised there was nothing wrong on the azure side (network gateway and local gateway) so we have involved Meraki support and are waiting to hear back from them.
KapilAnanth-MSFT 35,416 Reputation points Microsoft Employee

2024-03-19T06:55:15.2+00:00

@Sharyn Schmidt ,

Sure.

Thanks for keeping the thread updated.

Cheers,

Kapil
Sharyn Schmidt 241 Reputation points

2024-03-27T15:04:23.1366667+00:00

Perfect, thank you!
KapilAnanth-MSFT 35,416 Reputation points Microsoft Employee

2024-03-27T15:09:24.25+00:00

@Sharyn Schmidt ,

You are most welcome.

I have summarized our discussion and posted it as a new answer.

I would highly appreciate if you could Accept the answer and close this thread

Original posters help the community find answers faster by identifying the correct answer.

Thanks,

Kapil

1 answer

KapilAnanth-MSFT 35,416 Reputation points Microsoft Employee

2024-03-14T06:29:21.8766667+00:00
@Sharyn Schmidt ,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I understand that you are in the process of creating a S2S Tunnel between Azure VPN Gateway and cisco Meraki device.

You can use Diagnostic Logs to check what exactly is the issue here.

The logs you should be checking is TunnelDiagnosticLog

AzureDiagnostics | where Category == "TunnelDiagnosticLog" //| where remoteIP_s == "<REMOTE IP OF TUNNEL>" | project TimeGenerated, OperationName, remoteIP_s, instance_s, Resource, ResourceGroup | sort by TimeGenerated asc

You may check this for past 1 hour and see what is the error.

Also, may I ask what error are you getting when you try to open a support ticket?

Cheers,

Kapil
Please sign in to rate this answer.
Sharyn Schmidt 241 Reputation points

2024-03-14T14:23:09.2066667+00:00

Hi Kapil. Thank you for your help. I have managed to create a support ticket. I will let support figure this out. Unfortunately, Azure is not my only responsibility so Im not really good at this. I did try to set up diagnostics logging but I don't think I did that correctly either!

Sharyn Schmidt 241 Reputation points

2024-03-26T17:52:00.3266667+00:00

So, as requested, I'm updating this question. We are NOT able to have both an azure network gateway AND the meraki VMX advertise the same route, which was the reason we were doing this to begin with - redundancy. We were finally able to get the tunnel up from the local meraki to the azure network gateway, however, the traffic could not reach the VM we were trying to hit because the route was already being advertised by the VMX. For this situation, the only way to get this to work would be to remove the route from the VMX which will hose the other sites that also need to get to the VM. I did have an additional question though. Can one azure network gateway host multiple local gateways one for each different device?

KapilAnanth-MSFT 35,416 Reputation points Microsoft Employee

2024-03-27T10:25:45.9366667+00:00

@Sharyn Schmidt ,

Thanks for keeping us updated.

I take it that your requirement is to establish two VPN Connections from Azure,

One from Azure VPN Gateway

and Other from VMX

towards your OnPrem Meraki device.

As you mentioned, this won't be possible because of Route advertisements within the Virtual Network.

Wrt your question, "Can one azure network gateway host multiple local gateways one for each different device?"

Yes, this is possible.

When you say different device - In case these different devices belong to different OnPrem locations (and hence different Address Ranges), you can just create a regular S2S Connection and traffic will be up

See : Multiple Locations

In case these different devices belong to same OnPrem locations (and hence same Address Ranges), you can still create S2S Connections but BGP is mandatory.

See : Multiple on-premises VPN devices

In both the cases, make sure you understand the maximum number of S2S Connections according to the SKU : SKU Comparison

Cheers,

Kapil

Sharyn Schmidt 241 Reputation points

2024-03-27T14:30:19.9233333+00:00

Thank you. Yes, I was trying to add a redundant connection in case either the vmx or our hq mx84 crashed. What I am trying to do is, I have 3 different parking garages, different locations, different ip ranges, different merakis. My question is, does each each different garage need the exact same setup for the vpn (the azure network gateway and the local network gateway) or can I use the azure network gateway as the gateway all the local network gateways can feed in to or does each garage need its own local network gateway and azure network gateway if the traffic is all being routed to the same azure vnet?

KapilAnanth-MSFT 35,416 Reputation points Microsoft Employee

2024-03-27T15:02:03.7866667+00:00

@Sharyn Schmidt ,

Redundant indicates same location, but multiple connections.

This can be achieved with the help of BGP

Let's say you have two devices in the same location, you should use a single VPN Gateway and two LNG (each representing a single device) with the 2 IP Addresses of the 2 Devices.

You just have to configure the 2 Public IP Addresses to the 2 LNGs you created and leave the Address space field empty.

BGP is a must for this.

This is documented in : Multiple on-premises VPN devices

When you say "I have 3 different parking garages, different locations, different ip ranges, different merakis"

This means multiple connections to various locations.

BGP is not mandatory as long the IP ranges are different.

Here also, a single VPN Gateway is sufficient.

Create different LNGs, each representing a single "Garage". You can configure each of these LNGs with the ip ranges and public IP of the Meraki device from the corresponding "Garage"

This is : Multiple Locations

In both the cases, you must create individual connections from VPN Gateway to the LNG(s).

Hope this helps.

Cheers,

Kapil
Sign in to comment