cities skylines making realistic cities without unlimited money

For example, in a hub and spoke topology you can tag all the spokes with “spoke” and use this tag under the peer availability configuration.Ĭonfiguration of the Cisco ASA side Phase-1 To tag networks, you must go to the Organization > Overview page, expand the table, select one or more network then click the “Tag” button to add or remove tags for the selected networks. In this case, only the networks with this tag will connect to the peer. For that, you can choose between “All networks” and in this case, all MX of your organization will connect to the peer, or you can set a specific network tag or set of tags. As theses settings are valid for the entire organization, not only for the site or network, we can configure which MX unit in the organization will connect to this peer. The availability setting on the MX is quite smart. Unfortunately, I have no more information on this point. It is still a security risk to disable PFS and it looks like a bug. The Meraki documentation recommend to disable PFS. Phase-2įor the phase-2, I experienced problems with the PFS between Cisco ASA and Meraki MX. Phase-1įor the ASA, the Phase-1 settings correspond to the crypto policy. Of course, theses settings must match on the peer device. You can choose between the “Default” settings, pre-set settings for AWS or Azure, or “custom” settings.

When you click on the IPSec policies, a popup appears with the Phase 1 and Phase 2 settings. The WAN IP, the private subnet and the pre-shared key do not need explanation.

Here you can give a name, the WAN IP of the VPN peer, the private subnets of the remote site, the IPSec policies for phases 1 and 2 the pre-shared secret key and the “Availability”. On the Meraki MX, the configuration for “Non-Meraki VPN peers” is under: Security Appliance > Site-to-site VPN > Organization-wide settings > Non-Meraki VPN peers. The tests below have been made with MX version 14.31 (in beta at the time I write this post) and 13.33, the results were the same with both versions. Here are some tips to avoid problems and save you time. This project also includes a migration phase with site-to-site VPN tunnels between Meraki MX and Cisco ASA.Įven if the “Non-Meraki VPN peers” are supported on the Meraki MX, you may have some surprises with the Cisco ASA. As I wrote on my recent post here, I was involved into a project to implement a Meraki MX into the Azure Cloud.

Cities skylines making realistic cities without unlimited money