Site-To-Site VPN between Meraki MX and FTD Managed by FMC

[Cole Riese]

Hi there, has anyone had any success setting up a site-to-site VPN between a Cisco FTD being managed by FMC and a Meraki MX device? For the life of me, I can't figure out how to get it to work. The configuration on both seems to match, but I'm unable to ping across or access anything on either end.

[Rob Ingram]

@Cole Riese is the tunnel actually up? From the FTD you can run "show crypto ipsec sa" confirm you have IPSec SAs between the 2 peers and the encap|decap counters are increasing. If you have no IPSec SAs then enable ike debug and provide the output for review.

On the FTD side have you configured a NAT exemption rule to ensure traffic between the 2 networks is not unintentially translated? Have you created an Access Control rule to permit traffic between the local and remote networks?

To troubleshoot from the FTD CLI you can run packet-tracer to simulate the traffic flow, run this twice and provide the output for review.

[Cole Riese]

@Rob Ingram The tunnel shows online in the FMC and on the Meraki "VPN Status" page. Here is the Tunnel Status from the FMC:

I have configured a NAT exemption rule and made sure to add ACL rules to allow traffic both ways.

I tried running the packet-tracer command on the FTD CLI, but I'm not sure what to set for the parameters.