Site-to-Site VPN between Meraki and ASA Using the CLI

If you need to create a site-to-site VPN between an ASA and Meraki Security Appliance, it’s fairly quick. I recommend using the CLI on the ASA for the configuration.

ASA CLI Configuration Steps:

Step 1: Configure ISAKMP Policy (Phase 1)

Step 2: Configure IPsec Transform set

Step 3: Create an access list matching the addresses to communicate over the VPN tunnel   

Step 4: Exclude the VPN traffic from being natted

Step 5: Define a crypto map referencing to step 2, 3 and the outside interface of the MX. Only static crypto maps are supported.

Step 6: Set the data lifetime to unlimited

Step 7: Apply the crypto map to the outside interface

Step 8: Configure the tunnel group and the pre-shared key.

Find other Networking Topics like this on the networking section of our blog!

Meraki-Side Configuration Steps:

On the Meraki side of the configuration, it will all be done by using the Meraki dashboard. Navigate to Security & SD-WAN > Configure > Site-to-Site VPN and you will see the following list of options:

Site-to-site VPN

• Type
  • Off
  • Hub
  • Spoke
• Hubs
  • If ‘Hub’ type is selected this will be your exit hub.
  • If ‘Spoke’ type is selected, the MX will send all site-to-site traffic to its configured VPN hubs.

VPN Settings

• VPN subnet translation
• NAT traversal
• Remote VPN participants

OSPF Settings

• Can choose to advertise remote routes

Organization-wide Settings

• Non-Meraki VPN peers
• Site-to-site outbound firewall
• Site-to-site inbound firewall

Alison Wallick, Network Support Engineer

Other Networking Basics:

Taking and Restoring ASDM Backups

Setting up SSH and Local Authentication 

Upgrading ASA and ASDM Images on New ASAs

Setting Up New Meraki Access Points

Adding and Removing Devices from the Meraki Dashboard

Upgrading an ASA ROMMON Version

Configuring a Cisco Router as DHCP Server