Firewpower 2110 and Meraki MX100

[oscar.montoya1]

Hello,

I have a Firepower 2110 integrated with FMC. I have several VPNs-Site-to-Site configured. The concentrator is the Firepower and my remote peers are all meraki. We want to homologate that these VPNs work between Merakis only. So, I am trying to confirm the below idea:

If I connect the Meraki behind my Firewpower I think the Meraki is not going to establish the VPNs because my public address will be directly connected to my Firepower. The same applies if I have the Firepower connected behind the Meraki, rigth? The VPNs will be established between the Merakis but I won't be able to use the Firepower for RAVPN for example. 

My assumption is correct?

I have more than 1 Public IP address, can this help me in some way or not?

Thanks for your help.

[Marvin Rhoads]

You can put the Meraki VPN hub behind the Firepower with a private address and give it a static NAT to a unique public address. Then allow the incoming traffic for VPN establishment through the Firepower.

You can also just run the Meraki in parallel with the Firepower and each would have its own unique public IP address.

You would need to make sure your interior routes know to use the Meraki inside address for reaching the remote site's subnets. Ideally that would be via a dynamic routing protocol.