VMX 100 communication with multiple AWS account and VPCs

[Blur_nom]

Hi Guys,

I have set up a vMX on a VPC in AWS. The vMX is able to communicate with another VPC through peering. However, if i were to have a site to site VPN configured for the vMX to a physical MX. The clients behind the physical MX were not able to reach the VPC. According to AWS, VPC peering doesn't support L3 routing information which is why i wasn't able to reach the VPC.

Any recommendation? This is my setup. MX -> VMX -> VPC

Also what is the best way to connect up my VMX to multiple VPC across multiple AWS accounts.

[CarolineS-Meraki]

Haha hi @THE_Daghan! Nice to see you here 🙂

[THE_Daghan]

Thanks CarolineS. I couldn't stay away. 🙂

[Hani Elgaali]

Hi everyone,

Have you tried AWS transit gateway! it's a new service I tested and it worked for that use case you need. In my lab, I have the following diagram. and I was able to ping "storage" client from the client behind the physical MX.

Also, Transit gateway works between different accounts as per this here:

I hope this helps someone!

[Philip D'Ath]

Thanks for that @Hani Elgaali .

I've talked to many customers about this, but haven't actually had the opportunity to do one of these yet.

[louie1]

Hi Helgaali,

Can you share what VPC configuration you have done or what routing table entries you created. We are trying the same approach in our lab and using your example, we cannot ping storage from behind the MX.

Thanks.

[DTanzmann]

Hi helgaali

(referring your diagram)

how did you setup routes back to MX from VPC-A linked through Transit GW?

I can ping client behind the transit GW in VPC-A from vMX but cannot ping this client from MX

thanks

David

[DTanzmann]

I have figured it out ... it actually work pretty well!!!

[bforst14]

Any chance you can provide guidance on your VPC/TGW routing? I have a vMX vpc with the appliance set up. Cant figure our which mode to use and how to configure routing to enable bidirectional flow.

[Philip D'Ath]

This option - and you have to do it PRIOR to deploying the VMX.

[bforst14]

I've created a VPC with it's own egress path. I have my vMX in Passthrough mode. I have defined local subnets in vMX (AWS Subnets with VPC routes pointed to the TGW) and I have a summarized route in my VPC route table pointed at the vMX ENI. I also added a route for the summarized field MX range to my TGW pointed at the vMX VPC. Experiencing some pretty weird stuff where I can ping my AWS subnets from field office MXs but can't ping Field Segments in VPN from AWS Hosts. Thoughts? Hard to find full guide with VPC/TGW routing included.

[LibertyM01]

Hi helgaali,

I'm working on a similar design. Can you please share the configurations within your VPCs i.e Route Tables, Internet Gateway and Security Groups. Also, do you define the two VPCs as local to the VMX in the Meraki Dashboard.

Thanks!

[tyshawn76]

I'm running across this same issue. I have my vMX in a hub network with multiple VPCs connected to the hub VPC. Like others I can ping between the vMX and any device in any other VPC, but the return traffic from AWS is not be generated back to an on site subnet.

[bforst14]

I can help if you can better explain your topology. I have my vMX with its own Elastic IP assigned to the EC2 and an IGW for outbound. What does the route table look like in the VPC/subnet where your vMX is?

[tyshawn76]

So working with AWS when I had the VPC peering in place the routes were good tcpdump showed the traffic hitting the VM and the VM sending the traffic back. What was noticed is the next hop was not identifying the VMX as the next hop causing the packets to drop. The fix for me was to place transit gateway in place and then configure the routes in the TG/ each VPC / and the vMX. As on this moment I have traffic processing through the vMX to my VM.