Meraki Implementation

Reply
Highlighted
L1 Bithead

Meraki Implementation

Curious if anyone has Meraki and a PAN setup.  We are trying to to link our remote sites to the data center.  At the remotes the meraki is the router then in the data center we have the meraki behind the the PA.  We can establish a VPN tunnel and ping internal devices, but it is really slow.  For example logons to workstations take forever, and I mean it they never logon wheel keeps spinning, but if I get by that, web pages dont load even from internal servers that should not have to go bck to the palo alto.

 

We did the one arm concentrator mode, so it doesnt have a public IP, it sits in the trust zone with the other internal servers.  We started in the DMZ, put the policy righting got complex so more time consuming so we tabled that to just test performance.

 

We haev a call in into Meraki as well, but curious of others experiences.  Palo Alto has best practices for others, just not meraki.

Tags (2)
L7 Applicator

Re: Meraki Implementation

@bschaper,

I'm honestly suprised you actually got this to work at all to be honest. Have you verified through enabling interzone-default logging that the Palo Alto is actually not blocking any traffic. Meraki is generally pretty picky about being behind another firewall and if possible I would really recommend taking a look at redesigning your solution. 

Just to do some troubleshooting; have you tried moving the Meraki out from behind your Palo Alto, or another connection all-together, and verified that the issue isn't present even with your Palo Alto out of the picture? I would call that step-one of the process just to rule that out. 

L1 Bithead

Re: Meraki Implementation

I will turn on the logging.  Meraki has documentation on being behind a firewall and this morning it seems to be working better.  Almost like it takes time to improve service.  We discussed placing it outside the PA, but we still want to be able to use the PA to manage all user internet traffic.  

 

L0 Member

Re: Meraki Implementation

I'm trying tom implement this now too andnot having much luck.  Do you have a link to the documentatuon you mentioned?

 

Thanks,

L1 Bithead

Re: Meraki Implementation

So the docs have changed some, but here is the link:

 

https://documentation.meraki.com/MX-Z/Site-to-site_VPN/Site-to-site_VPN_Settings

 

I can see if I can find the old docs.

 

Overall I was not that impressed with Meraki, to get it to work we placed the device inside the network and did a static nat translation and just opened the ports.  Not ideal, but it was just a POC, we had a lot of small bugs in the Meraki software, that always seemed to be a software update away.

 

The biggest show stopper for us was the cellular failover and how you could not restrict traffic over it.  So we had a IP camera that streams constantly over the cell connection in HD.  Wasteful as a backup.  Other little bugs that I dont recall anymore.  We decided to look into ECMP and use PA devices at each site.  Seems like a better cost alternative.

 

A little birdie told me that Palo Alto may have some SD-WAN stuff in the works, third party or maybe, fingers cross internal.  I dont see why they could not build a basic implementation into their firewalls.  We didnt need any of the traffic shaping during normal business, we run thin clients and IP phones at the site so the protocols are minimal.  Meraki was fine for that and a reasonable price point over the competition.

L3 Networker

Re: Meraki Implementation

I have setup the One Arm VPN concentrator. I connected into the internal LAN, created a static bi-drectional NAT for it. On the meraki side, set it up as "Manual - Port Forwarding" and chose a port to use.

 

No issues like you're describing.  It has its use cases, but I'm not the biggest fan

L1 Bithead

Re: Meraki Implementation

Had the same setup, problem wasn’t at the headend although I did not find it to be the most reliable. The problem we had was at the remote sites that used cellular. Their built in firewall/router was just really basic. We consider Viptela as well but the price was VMUG her than we could justify.
L3 Networker

Re: Meraki Implementation

were the remote sites using the MX64? That's how I deployed at a client, they full tunneled everything to their DC.

L1 Bithead

Re: Meraki Implementation

64s and z3, just was feature lacking
L0 Member

Re: Meraki Implementation

After a marathon session with both Palo andMeraki we have this working now.  here are teh final notes fromteh Palo Support session

 

Please go through this document to understand this problem we were facing during NAT:
https://live.paloaltonetworks.com/t5/Learning-Articles/Session-setup-fails-due-to-session-hash-colli...

> Finally we created source static NAT (Not bi-directional) and after that all the tunnel was up and running as expected

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!