ML
    • Recent
    • Categories
    • Tags
    • Popular
    • Users
    • Groups
    • Register
    • Login

    EdgeRouter 4: IPSec, S2S vpn

    IT Discussion
    edgerouter edgerouter 4 vpn site-to-site
    6
    40
    2.6k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • FATeknollogeeF
      FATeknollogee @JaredBusch
      last edited by FATeknollogee

      @JaredBusch :thumbs_up: :thumbs_up_medium_skin_tone: :thumbs_up_medium-dark_skin_tone:
      I'll give that a try.

      1 Reply Last reply Reply Quote 0
      • FATeknollogeeF
        FATeknollogee
        last edited by FATeknollogee

        This post is deleted!
        1 Reply Last reply Reply Quote 0
        • FATeknollogeeF
          FATeknollogee
          last edited by FATeknollogee

          That previous error was due to copy/paste issues.

          Here is the error I'm getting:

          [ service nat ]
          NAT configuration error: rule type not specified/valid
          
          JaredBuschJ 1 Reply Last reply Reply Quote 0
          • JaredBuschJ
            JaredBusch @FATeknollogee
            last edited by JaredBusch

            @FATeknollogee said in EdgeRouter 4: IPSec, S2S vpn:

            That previous error was due to copy/paste issues.

            Here is the error I'm getting:

            [ service nat ]
            NAT configuration error: rule type not specified/valid
            

            The NAT above was exported from a live router using show configuration command service | grep nat

            Are you running 2.0? maybe something changed?

            Edit: Nope
            7028e6cd-8f03-4e36-aed9-0fe3cfcf981f-image.png

            ba161b2e-4d41-457c-9630-3cfe41a58251-image.png

            1 Reply Last reply Reply Quote 0
            • JaredBuschJ
              JaredBusch
              last edited by JaredBusch

              Never mind. I read the error closer.. I missed a line when I copy/pasted
              fixed above also.

              set service nat rule 5000 type masquerade
              
              FATeknollogeeF 1 Reply Last reply Reply Quote 1
              • FATeknollogeeF
                FATeknollogee @JaredBusch
                last edited by

                @JaredBusch said in EdgeRouter 4: IPSec, S2S vpn:

                Never mind. I read the error closer.. I missed a line when I copy/pasted
                fixed above also.

                set service nat rule 5000 type masquerade
                

                Haha, just added that line like 2 mins ago!!
                Thanks for fixing!!

                1 Reply Last reply Reply Quote 0
                • FATeknollogeeF
                  FATeknollogee
                  last edited by

                  ER4 <--> Meraki MX S2S is "up"
                  Many thanks to @JaredBusch for all the help.

                  1 Reply Last reply Reply Quote 2
                  • FATeknollogeeF
                    FATeknollogee
                    last edited by

                    @JaredBusch
                    S2S #1: ER4 (ip 1.2.3.4) <--> Meraki MX is up
                    S2S #2: ER4 (ip 1.2.3.4) <--> Unifi USG not working, just says "connecting" (when I run "show vpn ipsec sa)

                    Any tricks or tips to make S2S #2 work?

                    JaredBuschJ 1 Reply Last reply Reply Quote 0
                    • JaredBuschJ
                      JaredBusch @FATeknollogee
                      last edited by

                      @FATeknollogee said in EdgeRouter 4: IPSec, S2S vpn:

                      @JaredBusch
                      S2S #1: ER4 (ip 1.2.3.4) <--> Meraki MX is up
                      S2S #2: ER4 (ip 1.2.3.4) <--> Unifi USG not working, just says "connecting" (when I run "show vpn ipsec sa)

                      Any tricks or tips to make S2S #2 work?

                      USG sucks...

                      FATeknollogeeF 1 Reply Last reply Reply Quote 0
                      • FATeknollogeeF
                        FATeknollogee @JaredBusch
                        last edited by

                        @JaredBusch Don't talk bad about my USG :grinning_face_with_smiling_eyes:
                        In a few week I plan on replacing the USG w an ER4.

                        For now, I was able to get the ER4 <--> USGp4 connection up & running...:thumbs_up:

                        1 Reply Last reply Reply Quote 0
                        • FATeknollogeeF
                          FATeknollogee
                          last edited by

                          I have 2 public IPs on the USGp4 (using WAN 1 & 2)
                          For some reason, the second peer (of my S2S) ER4 refuses to connect to the USGp4 WAN1 IP.
                          I finally tried WAN2 & it connected.

                          1 Reply Last reply Reply Quote 0
                          • FATeknollogeeF
                            FATeknollogee
                            last edited by FATeknollogee

                            update:
                            ER4 <--> S2S <--> Meraki MX is/was an absolute disaster.
                            No workie!!!
                            For now, have to scrap the idea, it just doesn't work :angry_face: :face_with_open_mouth_cold_sweat:

                            JaredBuschJ 1 Reply Last reply Reply Quote 0
                            • JaredBuschJ
                              JaredBusch @FATeknollogee
                              last edited by

                              @FATeknollogee said in EdgeRouter 4: IPSec, S2S vpn:

                              update:
                              ER4 <--> S2S <--> Meraki MX is/was an absolute disaster.
                              No workie!!!
                              For now, have to scrap the idea, it just doesn't work :angry_face: :face_with_open_mouth_cold_sweat:

                              I don’t know enough about the Meraki side. But one would assume it can work. IPSEC is a standard.

                              RojoLocoR 1 Reply Last reply Reply Quote 0
                              • RojoLocoR
                                RojoLoco @JaredBusch
                                last edited by

                                @JaredBusch said in EdgeRouter 4: IPSec, S2S vpn:

                                @FATeknollogee said in EdgeRouter 4: IPSec, S2S vpn:

                                update:
                                ER4 <--> S2S <--> Meraki MX is/was an absolute disaster.
                                No workie!!!
                                For now, have to scrap the idea, it just doesn't work :angry_face: :face_with_open_mouth_cold_sweat:

                                I don’t know enough about the Meraki side. But one would assume it can work. IPSEC is a standard.

                                You probably have to rub some cash on the Meraki to get it to work.

                                JaredBuschJ 1 Reply Last reply Reply Quote 1
                                • JaredBuschJ
                                  JaredBusch @RojoLoco
                                  last edited by

                                  @RojoLoco said in EdgeRouter 4: IPSec, S2S vpn:

                                  @JaredBusch said in EdgeRouter 4: IPSec, S2S vpn:

                                  @FATeknollogee said in EdgeRouter 4: IPSec, S2S vpn:

                                  update:
                                  ER4 <--> S2S <--> Meraki MX is/was an absolute disaster.
                                  No workie!!!
                                  For now, have to scrap the idea, it just doesn't work :angry_face: :face_with_open_mouth_cold_sweat:

                                  I don’t know enough about the Meraki side. But one would assume it can work. IPSEC is a standard.

                                  You probably have to rub some cash on the Meraki to get it to work.

                                  That was assumed.

                                  1 Reply Last reply Reply Quote 0
                                  • FATeknollogeeF
                                    FATeknollogee
                                    last edited by

                                    The problem is this:
                                    On the Meraki side, let's say you have 5 (this can be any number greater than 1) firewalls.
                                    In Meraki speak, if all 5 are in the same "organization", S2S is a few clicks & AutoVPN takes over. No pre-shared secret, no keys.
                                    You turn on VPN, say yes to whatever subnets you want in the vpn & save.

                                    On the ER side, I have to create 5 peers to connect to the Meraki side.
                                    Meraki will only expose one connection for a 3rd party S2S & therein lies the problem.
                                    Not all the tunnels connect & there's no good way to fix it.

                                    1 Reply Last reply Reply Quote 0
                                    • 1
                                    • 2
                                    • 2 / 2
                                    • First post
                                      Last post