Meraki to Azure site-site VPN

Gareth Parry 1

HI,

We have a number of site all with a meraki MX firewall. We have a VM in azure and i need to be able to access this from our sites. All our sites have BT internet connections Initially i set up a virtual gateway in azure and then site-site VPNs for all our sites. I had to set the BT routers to bridge mode to avoid double NATing.

This all worked fine until we upgraded the BT lines and you cannot set the new hubs to bridge mode, and i can not go back to the old hubs as they dont support the BT hybrid backup.

instead i installed a VMX in azure and connected all the sites to this. They all connected fine, but i kept getting timeouts when accessing data on the azure VM from our sites. Neither Cisco or MS could fix this issue.

what other options do i have?

thanks

Gareth

Silvia Wibowo 3,986 Reputation points Microsoft Employee

2024-07-08T03:20:49.9366667+00:00

Hi @Gareth Parry , when you say "We have a VM in azure and i need to be able to access this from our sites" - what kind of access? Is it RDP, HTTP/S, other protocol?
Gareth Parry 1 Reputation point

2024-07-08T09:35:30.36+00:00

Hi,

its running IIS and i need to be able to access websites on it, without exposing them to the web.

thanks
Silvia Wibowo 3,986 Reputation points Microsoft Employee

2024-07-09T23:42:09.22+00:00
Hi @Gareth Parry , so it's a VM with IIS. You want to control access to the website.

A few options (non-exhaustive list, there may be other options available):

Configure NSG (Network Security Group) for your VM to only allow selected Public IP address to access your website in IIS. This is suitable if your remote sites have fixed Public IP addresses. Then add a Public IP Address to your IIS VM. Your users will access IIS VM via Internet, but you control which Public IP addresses can access your IIS VM.

Use Azure VPN Gateway - it used to work with BT bridge mode, why doesn't it work with the new BT configuration?

Troubleshoot further with Cisco on why Meraki VMX connection timeouts.

Use other VPN server that's compatible with Meraki MX as VPN client, may be OpenVPN?

Use Azure P2S VPN.

Similar to #1, but use an External Load Balancer instead of attaching Public IP address to IIS VM directly.
KapilAnanth-MSFT 46,956 Reputation points Microsoft Employee

2024-07-10T07:02:19.7733333+00:00
@Gareth Parry ,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

Looking at your verbatim, it looks like you are using a 3rd party VPN Device in Azure and not a VPN Gateway, is that correct?

In that case, did you check the configuration from Meraki documents?

Make sure traffic is being forwarded to the VPN NVA (in Azure) using UDRs.

Cheers,

Kapil
Gareth Parry 1 Reputation point

2024-07-10T08:54:10.24+00:00

Hi @Silvia Wibowo I hadn't considered option 1 before that might be the way to go. ill look further into this.

BT bridge mode is no longer an option as the new BT hubs do not support bridge mode

Cisco have investigated using packet captures and confirm issue is not the connection between our onsite MX and the VMX in Azure. MS support couldn't understand what i was trying to do and went round in circles.
Gareth Parry 1 Reputation point

2024-07-10T08:56:44.95+00:00

Hi @kapilananth

i was trying to use a cisco vmx in azure, but gave up as it wasnt working correctly and neither cisco or MS could resolve.

i followed the Meraki documents and used a route table to route the traffic
KapilAnanth-MSFT 46,956 Reputation points Microsoft Employee

2024-07-10T09:19:13.5766667+00:00

@Gareth Parry ,

I am afraid I cannot comment on the configuration of a 3rd party NVA (cisco vmx) and how it works.

I would suggest you to continue working with Azure or the third party's support to validate the configuration.

Cheers,

Kapil

Share via

Meraki to Azure site-site VPN

Your answer