Meraki Site-to-site VPN makes it easy to connect remote networks and share network resources. In the event that VPN fails or network resources are inaccessible, there are several places to look in Dashboard to quickly resolve most problems. This article will overview common site-to-site VPN issues and recommended troubleshooting steps.
- Cisco RV340 as VPN Client I am attempting to set up a Cisco RV340 router to route all internet traffic through a VPN service such as IPVanish, Nord VPN, TorGuard, PIA, etc. I am having trouble figuring out which of these services will support the protocols used by the RV340.
- The United States Code is a consolidation and codification by subject matter of the general and permanent laws of the United States. It is prepared by the Office of the Law Revision Counsel of the United States House of Representatives.
- I've done quite a few site-to-site VPNs with Cisco Small Business Routers. But I've never done one from scratch for Client-to-Site. I'm converting the site from an old Netgear FVS336Gv2 router with a Cisco RV340 Dual WAN VPN Router and have a few questions.
Cisco rv340 client to site VPN: 4 facts everybody needs to know A device that operates part the provider's centre network. Some websites, withal, stamp hit to known IP addresses utilized by VPNs to let the circumvention of their geo-restrictions, and many VPN providers have been processing strategies to fuddle around these blockades.
Troubleshooting
If there appears to be an issue with VPN, start by referencing the Security & SD-WAN > Monitor > VPN status page to check the health of the appliance's connection to the VPN registry and the other peers. If one specific tunnel is having issues, it may be helpful to check the status page for the networks of each peer in case one of them is offline or disconnected from the registry:
The following sections outline common issues with site-to-site VPN and recommended troubleshooting steps:
Can't ping or access network resources on the other network
If you are unable to connect to devices on the other network from your site: Online shopping website in php source code.
- Are both devices online and connected to the registry?
- As outlined above, be sure to check the Security & SD-WAN > Monitor > VPN status page for each side's Dashboard network.
- Is the subnet you're trying to reach advertised over VPN?
- On the remote side's Dashboard network, navigate to Security & SD-WAN > Configure > Site-to-site VPN. Under Local networks, make sure the Use VPN toggle is set to Yes for the subnet you're trying to reach.You should also check these settings on your local site's Dashboard network to ensure that the subnet you're connecting from is also advertised.
- If using a full tunnel configuration, bear in mind that when specifying a prefix to be part of a VPN, everything covered by that prefix will be allowed in the VPN. Therefore, subnets that overlap will cause traffic in a more specific subnet to be sent through the VPN, even if it is not configured to be included in the VPN. For example, if 10.0.0.0/16 is configured to be included in the VPN but 10.0.1.0/24 is not, traffic sourced from 10.0.1.50 will still be sent over the VPN.
- Are any firewalls blocking this traffic on the network?
- In addition to any non-Meraki firewalls on the network that may be blocking this traffic (including firewalls that may be enabled on the device you're trying to access), check the Security & SD-WAN > Configure > Site-to-site VPN > Organization-wide settings section to see if there are any Site-to-site outbound firewall rules.
- Are there any problems reaching out to non-VPN peers?
- Try sending pings or traceroutes to public IPs (such as 8.8.8.8) or access public websites to see if the problem isn't strictly related to VPN.
- Try pinging the public IP of the other MX from your local network. If this fails but general Internet connectivity appears to be fine, there is likely an upstream ISP routing issue that is preventing the two sites from communicating directly even though they both have Internet access and are connected to the VPN registry.
- Are there routes configured on both sides that point to the remote subnets?
- If the MX is not the only gateway in the network (e.g. the MX is connected to a layer 3 switch or router with its own directly connected networks), any devices that are not using the MX as their gateway will need their traffic routed to the MX in order to send traffic across the VPN. Make sure any other routing devices on the network have a route that allows them to access the remote VPN subnets via the MX's local IP address.
- For extensive details on deploying the MX as a VPN concentrator, please refer to our VPN Concentrator Deployment Guide.
- Are these devices on non-overlapping subnets?
- If the device on each end is on a subnet that overlaps with the other side, the MX will be unable to route traffic to the other side as it will believe the traffic is destined for the local network. It is recommended to have unique subnets with no overlap on each network connected to the VPN.
- If identical networks are required on each side of a tunnel, you may need to enable VPN Subnet Translation. Please note that this feature does not allow for partial overlap between subnets, and is not supported with non-Meraki VPN peers.
VPN status page reports an unfriendly NAT or disconnected from VPN Registry
If the Security & SD-WAN > Monitor > VPN status page for a given network reports either 'NAT type: Unfriendly' or 'VPN Registry: Disconnected', there is likely a device upstream of the MX for that site that is preventing AutoVPN from working correctly.
- NAT type: Unfriendly indicates that the upstream NAT won't allow the MX to use UDP hole punching to form the tunnel. It is recommended to set NAT traversal to Manual: Port forwarding to bypass this issue.
- VPN Registry: Disconnected indicates that the upstream device is not allowing the MX to communicate with the VPN registry. It is recommended to configure any upstream firewalls to allow the traffic listed in Dashboard under Help > Firewall info.
For more information on these two error messages and VPN registry troubleshooting in general, please reference our documentation regarding Troubleshooting VPN Registration for Meraki AutoVPN.
Problems with VPN between Meraki MX/Z-series and a non-Meraki peer
If you are having issues with a non-Meraki VPN connection and the above troubleshooting tips did not resolve the issue, please reference our documentation regarding Troubleshooting Non-Meraki Site-to-Site VPN Peers.
Objective
A Virtual Private Network (VPN) is the connection between the local network and a remote host through the Internet. The local and the remote hosts may be a computer, or another network whose settings have been synchronized to allow them to communicate. This is true on all types of VPN. It typically allows both networks to have access to the resources on both sides of the connection. A VPN connection is commonly utilized in connecting a second office to the main office, or allowing a remote worker to connect to the computer network of the office, even if he is not physically connected to the network infrastructure. Remote workers typically connect via a VPN software client like AnyConnect, Shrew Soft, GreenBow and many others.
This article aims to show you how to configure a site-to-site VPN connection between an RV340 and an RV345 Router. It will call the primary router the local router, and the secondary router will be called the remote router. Be sure to have remote or physical access to the secondary router.
Applicable Devices
- RV340
- RV340W
- RV345
- RV345P
Software Version
- 1.0.03.15
Special Notice: Licensing Structure - Firmware versions 1.0.3.15 and later. AnyConnect will incur a charge for client licenses only.
For additional information on AnyConnect licensing on the RV340 series routers, check out the article AnyConnect Licensing for the RV340 Series Routers.
Configure a VPN Connection
Local Router
Step 1. Log in to the web-based utility of the local router and choose VPN > Site-to-Site.
Note: In this example, an RV340 is used.
Step 2. Click the plus icon.
Step 3. Ensure that the Enable check box is checked. It is checked by default.
Step 4. Enter the name of the connection in the Connection Name field.
Note: In this example, the name is TestVPN1.
Step 5. Choose the security settings of the connection from the IPSec Profile drop-down list. The options will depend on the IPSec Profiles created. For instructions on how to create an IPSec Profile, click here.
Note: In this example, CiscoTestVPN is chosen.
Step 6. Choose the interface to be used by the local router. The options are:
- WAN1 — This option will use the IP address of the Wide Area Network 1 (WAN1) interface of the local router for the VPN connection.
- WAN2 — This option will use the IP address of the WAN2 interface of the local router for the VPN connection. WAN2 is not available in single-WAN routers.
- USB1 — This option will use the IP address of the Universal Serial Bus 1 (USB1) interface of the local router for the VPN connection.
- USB2 — This option will use the IP address of the USB2 interface of the local router for the VPN connection. USB2 is not available on single-USB routers.
Note: In this example, WAN1 is chosen.
Step 7. Choose the identifier of the WAN interface of the remote router. The options are:
- Static IP — This option will let the local router use the static IP address of the remote router when establishing a VPN connection. If this option is chosen on the local router, the remote router should also be configured with the same option.
- FQDN — This option will use the Fully Qualified Domain Name (FQDN) of the remote router when establishing the VPN connection.
- Dynamic IP — This option will use the dynamic IP address of the remote router when establishing a VPN connection.
Note: Interface identifier on the remote router should be the same as the Interface identifier of the local router. In this example, Static IP is chosen.
Step 8. Enter the IP address of the WAN interface of the remote router.
Note: In this example, 124.123.122.123 is used.
Step 9. Click the radio button for the Internet Key Exchange (IKE) Authentication Method that you need. The options are:
- Preshared Key — This option means that the connection will require a password in order to complete the connection. The preshared key should be the same on both ends of the VPN connection.
- Certificate — This option means that the authentication method is using a certificate generated by the router instead of a password when connecting.
Note: In this example, Preshared Key is chosen.
Step 10. Enter the preshared key for the VPN connection in the Preshared Key field.
Step 11. (Optional) Uncheck the Minimum Preshared Key Complexity Enable check box if you want to use a simple password for the VPN connection. This is checked by default.
Step 12. (Optional) Check the Show plain text when edit Enable check box to display the preshared key in plain text. This is unchecked by default.
Step 13. Choose the identifier type of the local network from the Local Identifier Type drop-down list. The options are:
- Local WAN IP — This option will identify the local network through the WAN IP of the interface.
- IP Address — This option will identify the local network through the local IP address.
- Local FQDN — This option will identify the local network through the FQDN, if it has one.
- Local User FQDN — This option will identify the local network through the FQDN of the user, which can be his email address.
Note: In this example, IP Address is chosen.
Step 14. Enter the identifier of the local network in the Local Identifier field.
Note: In this example, 124.123.122.121 is entered.
Step 15. Choose the IP Address type that may be accessed by the VPN Client from the Local IP Type drop-down list. The options are:
- Subnet — This option allows the remote side of the VPN to access the local hosts in the specified subnet.
- IP Address — This option allows the remote side of the VPN to access the local host with the specified IP address.
- Any — This option allows the remote side of the VPN to access any of the local hosts.
Note: In this example, Subnet is chosen.
Step 16. Enter the IP address of the network or host to be accessed by the VPN client in the IP Address field.
Note: In this example, the IP address is 10.10.10.1.
Step 17. Enter the Subnet Mask of the IP address in the Subnet Mask field.
Note: In this example, the subnet mask is 255.255.255.0.
Step 18. Choose the Remote Identifier Type from the drop-down list. The options are:
- Remote WAN IP — This option will identify the remote network through the WAN IP of the interface.
- Remote FQDN — This option will identify the remote network through the FQDN, if it has one.
- Remote User FQDN — This option will identify the remote network through the FQDN of the user, which can be his email address.
Note: In this example, Remote WAN IP is chosen.
Step 19. Enter the WAN IP address of the remote router in the Remote Identifier field.
Note: In this example, the remote identifier is 124.123.122.123.
Vpn Client Manager
Step 20. Choose the network type that the local network needs access to from the Remote IP Type drop-down list. The options are:
- IP Address — This option lets the local hosts access the remote host with the specified IP address.
- Subnet — This option lets the local hosts access the resources on the remote host with the specified subnet.
- Any — This option lets the local hosts access the resources on the remote host with any IP address.
Step 21. Enter the LAN IP address of the remote network in the IP Address field.
Note: In this example, the IP address is 192.168.2.1.
Vpn Client Tai Mien Phi
Step 22. Enter the subnet mask of the remote network in the Subnet Mask field.
Note: In this example, the subnet mask is 255.255.255.0.
Step 23. Click Apply.
Step 24. Click Save.
You should now have configured the VPN settings on the local router.
Remote Router
Step 1. Determine the VPN settings of the local router such as:
- Interface of the local and remote router to be used for the VPN connection.
- Wide Area Network (WAN) Internet Protocol (IP) address of the local and remote router.
- Local Area Network (LAN) address and subnet mask of the local and remote network.
- Preshared key, password or certificate for the VPN connection.
- Security settings of the local router.
- Firewall exemption for the VPN connection.
Step 2. Log in to the web-based utility of the router and choose VPN > IPSec Profiles.
Step 3. Configure the VPN security settings of the remote router, matching the VPN security settings of the local router. For instructions, click here.
Facebook phishing link. Step 4. On the web-based utility of the local router, choose VPN > Site-to-Site.
Step 5. Click the plus icon.
Step 6. Ensure that the Enable check box is checked. It is checked by default.
Step 7. Enter the name of the VPN connection in the Connection Name field. The connection name of the remote router may be different from the connection name specified in the local router.
Note: In this example, the Connection Name is TestVPN.
Step 8. Choose the IPSec Profile form the drop-down list. The options will depend on the IPSec Profiles created. For instructions on creating an IPSec Profile, click here.
Note: In this example, CiscoTestVPN is chosen.
Step 9. Choose the interface that the remote router will use for the VPN connection from the drop-down list. The options are:
- WAN1 — This option will use the IP address of the Wide Area Network 1 (WAN1) interface of the remote router for the VPN connection.
- WAN2 — This option will use the IP address of the WAN2 interface of the remote router for the VPN connection. WAN2 is not available in single-WAN routers.
- USB1 — This option will use the IP address of the Universal Serial Bus 1 (USB1) interface of the remote router for the VPN connection.
- USB2 — This option will use the IP address of the USB2 interface of the remote router for the VPN connection. USB2 is not available on single-USB routers.
Note: In this example, WAN1 is chosen.
Step 10. Choose the identifier of the WAN interface of the local router from the Remote Endpoint drop-down list. The options are:
- Static IP — This option will let the remote router use the static IP address of the local router when establishing a VPN connection. If this option is chosen on the local router, the remote router should also be configured with the same option.
- FQDN — This option will use the Fully Qualified Domain Name (FQDN) of the local route when establishing the VPN connection.
- Dynamic IP — This option will use the dynamic IP address of the local router when establishing a VPN connection.
Note: Interface identifier on the remote router should be the same as the Interface identifier of the local router. In this example, Static IP is chosen.
Step 11. Enter the WAN IP address of the local router.
Note: In this example, the IP address is 124.123.122.121.
Step 12. Click the radio button for the Internet Key Exchange (IKE) Authentication Method that you need. The options are:
- Preshared Key — This option means that the connection will require a password in order to complete the connection. The preshared key should be the same on both ends of the VPN connection.
- Certificate — This option means that the authentication method is using a certificate generated by the router instead of a password when connecting.
Note: In this example, Preshared Key is chosen.
Step 13. Enter the preshared key for the VPN connection in the Preshared Key field.
Step 14. (Optional) Uncheck the Minimum Preshared Key Complexity check Enable box if you want to use a simple password for the VPN connection. This is checked by default.
Step 15. (Optional) Check the Show plain text when edit Enable check box to display the preshared key in plain text. This is unchecked by default.
Step 16. Choose the identifier type of the remote network from the Local Identifier Type drop-down list of the remote router. The options are:
- Local WAN IP — This option will identify the remote network through the WAN IP of the interface.
- IP Address — This option will identify the remote network through the local IP address.
- Local FQDN — This option will identify the remote network through the FQDN, if it has one.
- Local User FQDN — This option will identify the remote network through the FQDN of the user, which can be his email address.
Note: In this example, IP Address is chosen.
Step 17. Enter the identifier of the remote network in the Local Identifier field of the remote router.
Note: In this example, 124.123.122.123 is entered.
Step 18. Choose the IP Address type that may be accessed by the VPN Client from the Local IP Type drop-down list. The options are:
- Subnet — This option allows the local side of the VPN to access the remote hosts in the specified subnet.
- IP Address — This option allows the local side of the VPN to access the remote host with the specified IP address.
- Any — This option allows the local side of the VPN to access any of the remote hosts.
Note: In this example, Subnet is chosen.
Step 19. Enter the IP address of the network or host to be accessed by the VPN client in the IP Address field.
Note: In this example, the IP address is 192.168.2.1.
Step 20. Enter the Subnet Mask of the IP address in the Subnet Mask field.
Note: In this example, the subnet mask is 255.255.255.0.
Step 21. Choose the Local Identifier Type from the drop-down list. The options are:
- Remote WAN IP — This option will identify the local network through the WAN IP of the interface.
- Remote FQDN — This option will identify the local network through the FQDN, if it has one.
- Remote User FQDN — This option will identify the local network through the FQDN of the user, which can be his email address.
Note: In this example, Remote WAN IP is chosen.
Step 22. Click Apply.
Step 23. Click Save.
You should now have configured the VPN settings on the remote router.