topic Re: Meraki MX DHCP capabilities in SSID VPN concentrator mode in Wireless

Meraki MX DHCP capabilities in SSID VPN conentrator mode

steve.blunt — Mon, 05 Jul 2021 18:22:35 GMT

Hi is it now possible to configure MX appliances in SSID VPN termination mode to act as a client DHCP server, this was not supported last time I looked.

Thanks

Re: Meraki MX DHCP capabilities in SSID VPN conentrator mode

balaji.bandi — Mon, 02 Dec 2019 20:11:23 GMT

not sure is this what you looking :

https://documentation.meraki.com/MR/Client_Addressing_and_Bridging/SSID_Tunneling_and_Layer_3_Roaming_-_VPN_Concentration_Configuration_Guide

Re: Meraki MX DHCP capabilities in SSID VPN concentrator mode

steve.blunt — Tue, 03 Dec 2019 09:42:34 GMT

Hi, yes I have seen this guide thanks, but there is no reference to DHCP capabilities. All that is required is for the MX to support DHCP for clients connecting to an SSID which terminates its tunnel on the MX

Re: Meraki MX DHCP capabilities in SSID VPN concentrator mode

Karsten Iwen — Tue, 03 Dec 2019 13:02:48 GMT

I'm also not sure if this is what you want:

When tunneling an SSID to an MX, you specify a local MX VLAN to terminate the SSID on. This VLAN is configured for DHCP and the client gets an IP out of that pool.

Re: Meraki MX DHCP capabilities in SSID VPN concentrator mode

steve.blunt — Tue, 03 Dec 2019 13:43:34 GMT

I think this is saying that the MX receives its IP address via DHCP, the documentation does not refer to the MX been able to run DHCP services to facilitate client addressing

Re: Meraki MX DHCP capabilities in SSID VPN concentrator mode

Karsten Iwen — Tue, 03 Dec 2019 14:04:51 GMT

The MX can get its IP in any way: static, DHCP or PPPoE. But for a central device running as a concentrator I would only use an internet-connection with statically assigned IPs.

For the client-addressing: Running a DHCP-server is one of the base features of the MX. Probably that's the reason the above document does not mention it.

Re: Meraki MX DHCP capabilities in SSID VPN concentrator mode

steve.blunt — Tue, 03 Dec 2019 14:08:34 GMT

Hi thanks for the reply. I was lead to believe the MX in VPN concentrator mode (one arm) was not capable of running client DHCP services. I'm struggling to find anything official in writing

Re: Meraki MX DHCP capabilities in SSID VPN concentrator mode

Karsten Iwen — Tue, 03 Dec 2019 14:29:42 GMT

Ok, I think I really did not get your environment. Up to now I only ran the concentrator on devices in NAT-Mode. Although "officially" unsupported it works fine. You are right that in passthrough there is no DHCP-server. But you should be able to provide DHCP-services from the upstream device. Or is exactly this what you want to avoid?

Re: Meraki MX DHCP capabilities in SSID VPN concentrator mode

steve.blunt — Tue, 03 Dec 2019 15:15:34 GMT

Hi thanks for coming back, all I'm looking for is for the MX to be a DHCP server when used to terminate SSID tunnels, Meraki's validated design says use one-arm pass through mode but does not mention DHCP capabilities

Re: Meraki MX DHCP capabilities in SSID VPN concentrator mode

Karsten Iwen — Tue, 03 Dec 2019 15:51:46 GMT

Yes, here you are right that the MX still can not provide DHCP. Is there any reason you don't want to use the upstream device at your MX-location for this task? There has to be a L3 device like a router or a firewall and that device should provide DHCP or at least send the DHCP-requests as a relay to the corporate DHCP server.

Re: Meraki MX DHCP capabilities in SSID VPN concentrator mode

steve.blunt — Tue, 03 Dec 2019 15:55:34 GMT

The reason for wanting the MX to provide DHCP is simply this is the case for the clients legacy on-prem wireless LAN controller. Effectively the client will need to provision a DHCP server for the Meraki solution as this functionality is not supported...shame really

Re: Meraki MX DHCP capabilities in SSID VPN concentrator mode

Karsten Iwen — Tue, 03 Dec 2019 16:41:50 GMT

In this use case I would look into the option to use the MX as the main firewall and use NAT-mode where you also can use DHCP-server.

Re: Meraki MX DHCP capabilities in SSID VPN concentrator mode

nmeadows02 — Mon, 24 Aug 2020 10:51:26 GMT

Hi,

The problem is this doesn't solve the essential question, which is how to get an MX concentrator at say the Headquarters site in "Passthrough mode" to service DHCP for wireless clients at a branch site? Given that the MX concentrator in one armed passtrhough mode, has no ability to run a DHCP server.

However, the above configuration, but with the MX concentrator in NAT or routed mode, works, but is not supported by Meraki and anyway (in my environment at least) the speed at the wireless client is very poor.