03 Meraki SD-WAN and Auto VPN (Concepts)
Meraki manages its devices from the cloud. That changes how you think about VPNs: you don’t configure a tunnel on each device, you declare intent in the Dashboard and the cloud distributes the details. This is the mental model before touching the configuration (Meraki Fundamentos y Dashboard and Auto VPN).
Contenido complementario
Not covered in my courses. Verified against the Meraki documentation (see Sources).
Cloud management
- Dashboard: web-based configuration and monitoring. There is no CLI.
- Hierarchy: organization → network → device.
- Changes are pushed to the devices; an MX that is disconnected from the cloud doesn’t receive them.
Auto VPN: what the cloud does for you
- Each MX registers with the VPN registry (public IP and UDP port).
- When you set an MX as hub or spoke, the cloud gives each device the information about its peers.
- The devices build tunnels between themselves (a variant of IPsec) without you configuring encryption, PSKs or proposals.
- The hubs and their order define the exit priority. A spoke reaches other spokes through the hub.
graph TD CLOUD["Meraki cloud<br/>(VPN registry, keys)"] -.-> HUB["MX hub"] CLOUD -.-> S1["MX spoke A"] CLOUD -.-> S2["MX spoke B"] S1 === HUB S2 === HUB
Auto VPN vs standard IPsec
| Auto VPN | Non-Meraki VPN peer (IPsec) | |
|---|---|---|
| Between which devices | Meraki only, same organization | Any IPsec device (or an MX in another organization) |
| Configuration | Hub/spoke and subnets | IKE, policy, PSK, IDs, subnets |
| Ports | UDP 9350–9381 (registry), UDP 32768–61000 (tunnels) | UDP 500/4500 |
| Authentication | Handled by the cloud | PSK |
| Dynamic routing | Meraki-internal | Optional (eBGP over IPsec, MX ≥ 19.1.4) |
SD-WAN: more than a VPN
On top of the tunnel Meraki adds performance-based path selection, traffic shaping and dual uplinks. For VPN work with Palo Alto, what matters is that the MX can move the tunnel between uplinks, so the peer must tolerate a change of public IP (with a backup IP or an FQDN).
Self-check
Q1 — Who distributes keys and peer information in Auto VPN?
A) A local RADIUS server
B) The administrator, by hand on each MX
C) The VPN registry in the Meraki cloud
D) The Palo Alto
Respuesta
C. The registry keeps each MX’s IP and port and gives each one the information to build tunnels. A) and D) take no part. B) is exactly what Auto VPN avoids.
Q2 — Which ports must an upstream firewall allow for Auto VPN registration?
A) UDP 500 and 4500
B) TCP 179
C) UDP 9350–9381 outbound
D) TCP 443 only
Respuesta
C. UDP 500/4500 are for non-Meraki IPsec tunnels and TCP 179 is BGP. D) covers another part of the Dashboard communication, not Auto VPN registration.
Q3 — A spoke doesn't see a hub subnet. What do you check first?
A) That the hub exports it with VPN mode Enabled
B) The tunnel PSK
C) The DH group
D) The phase 2 lifetime
Respuesta
A. Auto VPN has no PSK, DH or lifetimes to configure: what fails is which subnets are exported to the domain. B), C) and D) belong to manual IPsec.
Q4 — When would you use a Non-Meraki VPN peer instead of Auto VPN?
A) To connect two MX in the same organization
B) To connect an MX to a Palo Alto or to an MX in another organization
C) Never, it’s obsolete
D) Only for Wi-Fi
Respuesta
B. Auto VPN is only for Meraki devices in the same organization; other vendors or other organizations use standard IPsec. A) should use Auto VPN.