ML
    • Recent
    • Categories
    • Tags
    • Popular
    • Users
    • Groups
    • Register
    • Login

    EdgeRouter 4: IPSec, S2S vpn

    Scheduled Pinned Locked Moved IT Discussion
    edgerouteredgerouter 4vpnsite-to-site
    40 Posts 6 Posters 2.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • FATeknollogeeF
      FATeknollogee
      last edited by FATeknollogee

      That previous error was due to copy/paste issues.

      Here is the error I'm getting:

      [ service nat ]
      NAT configuration error: rule type not specified/valid
      
      JaredBuschJ 1 Reply Last reply Reply Quote 0
      • JaredBuschJ
        JaredBusch @FATeknollogee
        last edited by JaredBusch

        @FATeknollogee said in EdgeRouter 4: IPSec, S2S vpn:

        That previous error was due to copy/paste issues.

        Here is the error I'm getting:

        [ service nat ]
        NAT configuration error: rule type not specified/valid
        

        The NAT above was exported from a live router using show configuration command service | grep nat

        Are you running 2.0? maybe something changed?

        Edit: Nope
        7028e6cd-8f03-4e36-aed9-0fe3cfcf981f-image.png

        ba161b2e-4d41-457c-9630-3cfe41a58251-image.png

        1 Reply Last reply Reply Quote 0
        • JaredBuschJ
          JaredBusch
          last edited by JaredBusch

          Never mind. I read the error closer.. I missed a line when I copy/pasted
          fixed above also.

          set service nat rule 5000 type masquerade
          
          FATeknollogeeF 1 Reply Last reply Reply Quote 1
          • FATeknollogeeF
            FATeknollogee @JaredBusch
            last edited by

            @JaredBusch said in EdgeRouter 4: IPSec, S2S vpn:

            Never mind. I read the error closer.. I missed a line when I copy/pasted
            fixed above also.

            set service nat rule 5000 type masquerade
            

            Haha, just added that line like 2 mins ago!!
            Thanks for fixing!!

            1 Reply Last reply Reply Quote 0
            • FATeknollogeeF
              FATeknollogee
              last edited by

              ER4 <--> Meraki MX S2S is "up"
              Many thanks to @JaredBusch for all the help.

              1 Reply Last reply Reply Quote 2
              • FATeknollogeeF
                FATeknollogee
                last edited by

                @JaredBusch
                S2S #1: ER4 (ip 1.2.3.4) <--> Meraki MX is up
                S2S #2: ER4 (ip 1.2.3.4) <--> Unifi USG not working, just says "connecting" (when I run "show vpn ipsec sa)

                Any tricks or tips to make S2S #2 work?

                JaredBuschJ 1 Reply Last reply Reply Quote 0
                • JaredBuschJ
                  JaredBusch @FATeknollogee
                  last edited by

                  @FATeknollogee said in EdgeRouter 4: IPSec, S2S vpn:

                  @JaredBusch
                  S2S #1: ER4 (ip 1.2.3.4) <--> Meraki MX is up
                  S2S #2: ER4 (ip 1.2.3.4) <--> Unifi USG not working, just says "connecting" (when I run "show vpn ipsec sa)

                  Any tricks or tips to make S2S #2 work?

                  USG sucks...

                  FATeknollogeeF 1 Reply Last reply Reply Quote 0
                  • FATeknollogeeF
                    FATeknollogee @JaredBusch
                    last edited by

                    @JaredBusch Don't talk bad about my USG :grinning_face_with_smiling_eyes:
                    In a few week I plan on replacing the USG w an ER4.

                    For now, I was able to get the ER4 <--> USGp4 connection up & running...:thumbs_up:

                    1 Reply Last reply Reply Quote 0
                    • FATeknollogeeF
                      FATeknollogee
                      last edited by

                      I have 2 public IPs on the USGp4 (using WAN 1 & 2)
                      For some reason, the second peer (of my S2S) ER4 refuses to connect to the USGp4 WAN1 IP.
                      I finally tried WAN2 & it connected.

                      1 Reply Last reply Reply Quote 0
                      • FATeknollogeeF
                        FATeknollogee
                        last edited by FATeknollogee

                        update:
                        ER4 <--> S2S <--> Meraki MX is/was an absolute disaster.
                        No workie!!!
                        For now, have to scrap the idea, it just doesn't work :angry_face: :face_with_open_mouth_cold_sweat:

                        JaredBuschJ 1 Reply Last reply Reply Quote 0
                        • JaredBuschJ
                          JaredBusch @FATeknollogee
                          last edited by

                          @FATeknollogee said in EdgeRouter 4: IPSec, S2S vpn:

                          update:
                          ER4 <--> S2S <--> Meraki MX is/was an absolute disaster.
                          No workie!!!
                          For now, have to scrap the idea, it just doesn't work :angry_face: :face_with_open_mouth_cold_sweat:

                          I don’t know enough about the Meraki side. But one would assume it can work. IPSEC is a standard.

                          RojoLocoR 1 Reply Last reply Reply Quote 0
                          • RojoLocoR
                            RojoLoco @JaredBusch
                            last edited by

                            @JaredBusch said in EdgeRouter 4: IPSec, S2S vpn:

                            @FATeknollogee said in EdgeRouter 4: IPSec, S2S vpn:

                            update:
                            ER4 <--> S2S <--> Meraki MX is/was an absolute disaster.
                            No workie!!!
                            For now, have to scrap the idea, it just doesn't work :angry_face: :face_with_open_mouth_cold_sweat:

                            I don’t know enough about the Meraki side. But one would assume it can work. IPSEC is a standard.

                            You probably have to rub some cash on the Meraki to get it to work.

                            JaredBuschJ 1 Reply Last reply Reply Quote 1
                            • JaredBuschJ
                              JaredBusch @RojoLoco
                              last edited by

                              @RojoLoco said in EdgeRouter 4: IPSec, S2S vpn:

                              @JaredBusch said in EdgeRouter 4: IPSec, S2S vpn:

                              @FATeknollogee said in EdgeRouter 4: IPSec, S2S vpn:

                              update:
                              ER4 <--> S2S <--> Meraki MX is/was an absolute disaster.
                              No workie!!!
                              For now, have to scrap the idea, it just doesn't work :angry_face: :face_with_open_mouth_cold_sweat:

                              I don’t know enough about the Meraki side. But one would assume it can work. IPSEC is a standard.

                              You probably have to rub some cash on the Meraki to get it to work.

                              That was assumed.

                              1 Reply Last reply Reply Quote 0
                              • FATeknollogeeF
                                FATeknollogee
                                last edited by

                                The problem is this:
                                On the Meraki side, let's say you have 5 (this can be any number greater than 1) firewalls.
                                In Meraki speak, if all 5 are in the same "organization", S2S is a few clicks & AutoVPN takes over. No pre-shared secret, no keys.
                                You turn on VPN, say yes to whatever subnets you want in the vpn & save.

                                On the ER side, I have to create 5 peers to connect to the Meraki side.
                                Meraki will only expose one connection for a 3rd party S2S & therein lies the problem.
                                Not all the tunnels connect & there's no good way to fix it.

                                1 Reply Last reply Reply Quote 0
                                • 1
                                • 2
                                • 2 / 2
                                • First post
                                  Last post