Re: Non-Meraki VPN negotiation msg: FIPS mode disabled (2024)

Confirm that all Phase 1, Phase 2 and PSK settings are the same on both sites.

Non-Meraki VPN peers

You can create Site-to-site VPN tunnels between a Security Appliance or a Teleworker Gatewayand a Non-Meraki VPN endpoint device under theNon-Meraki VPN peerssection on theSecurity & SD-WAN > Configure > Site-to-site VPNpage. Simply click "Add a peer" and enter the following information:

A name for the remote device or VPN tunnel.
What IKE version to use (IKEv1 or IKEv2)*
The public IP address of the remote device.
The Remote ID of the remote peer. This is an optional configuration and can be configured to the remote peer’s UserFQDN (e.g.user@domain.com), FQDN (e.g. www.example.com)or IPv4 address as needed.
- Which of these values you use is dependent upon your remote device. Please consult its documentation to learn what values it is capable of specifying as its remote ID, and how to configure them (e.g.crypto isakmp identityfor ASA firewalls
The subnets behind the third-party device that you wish to connect to over the VPN. 0.0.0.0/0 can also be specified to define a default route to this peer.
- Note that if an MX-Z device is configured with a default route (0.0.0.0/0) to a Non-MerakiVPN peer, traffic will not fail over to the WAN, even if the connection goes down.
The IPsec policy to use.
The preshared secret key (PSK).
Availability settings to determine which appliances in your Dashboard Organization will connect to the peer.

*IKEv2 requires firmware version 15.12 or greater

When configuring NMVPN connections between 2 MXsin different organizations that are running MX15code and above that are not using a UserFQDNand are NATedbehind an upstream device, please ensure that the remote ID field of the NMVPN peer is filled out with the private IP address of the remote NATed MX.

Non-Meraki VPN Peering with FQDN

This feature enables theuse of FQDN instead of an IP address while configuring a Non-Meraki VPN peer. Using IP addresses can be tedious because with a dynamic IP address, a customer has to manually modify the Non-Meraki VPN settings on the Site-to-Site VPN page when there is an IP address change. With FQDN configuration, the hostname of the remote peer would automatically get resolved each time a connection is initiated.

“FQDN”differs from“User FQDN”. The MX resolves theFQDNto an IP address of the remote peer, whereas, “User FQDN” is used in conjunction with the IP address of the remote peer. “FQDN” identifies the remote peer and is configured in the “Public IP/Hostname”field.“User FQDN”identifies the local peer and is configured in the“Local ID”field.

NOTEFor IKEv2

Meraki Appliances build IPsec tunnels by sending out a request with a single traffic selector that contains all of the expected local and remote subnets. Certain vendors may not support allowing more than one local and remote selector in a given IPsec tunnel (e.g.ASA 5500-X series firewallsrunning certain firmware releases); for such cases, please use IKEv1 instead.

An MX-Z devicewill not try to form a VPN tunnel to a non-Meraki peer if it does not have any local networks advertised.

IPsec policies

There are three preset IPsec policies available.

Default:Uses the Meraki default IPsec settings for connection to a non-Meraki device
AWS:Uses default settings for connecting to an Amazon VPC
Azure:Uses default settings for connecting to a Microsoft Azure instance

If none of these presets are appropriate, theCustomoption allows you to manually configure the IPsec policy parameters. These parameters are divided into Phase 1 and Phase 2.

Phase 1

Encryption:Select between AES-128, AES-192, AES-256, and 3DES encryption
Authentication:Select MD5, SHA1or SHA256* authentication
Diffie-Hellman group:Select between Diffie-Hellman (DH) groups 1, 2,5 or 14*
Lifetime (seconds):Enter the phase 1 lifetime in seconds

* These settings requirefirmware version 15.12 or greater

Phase 2

Encryption:Select between AES-128, AES-192, AES-256, and 3DES encryption (multiple options can be selected)
Authentication:Select between MD5 and SHA1 authentication (both options can be selected)
PFS group:Select the Off option to disable Perfect Forward Secrecy (PFS). Select group 1, 2, or 5 to enable PFS using that Diffie Hellman group.
Lifetime (seconds):Enter the phase 2 lifetime in seconds

On May 8th 2018, changes were introduced to deprecate DES for encryption. Clickherefor more information.

NOTE:Please ensure the phase 2 lifetimes are equal on both ends of the tunnel whenever possible. While MX's can sometimes honor a shorter phase 2 lifetime if they're acting in response to build a tunnel, they cannot while serving as the initiator of the tunnel.

Peer availability

By default, a non-Meraki peer configuration applies to all MX-Zappliances in your Dashboard Organization. Since it is not always desirable for every appliance you control to form tunnels to a particular non-Meraki peer, the Availability column allows you to control which appliances within your Organization will connect to each peer. This control is based on network tags, which are labels you can apply to your Dashboard networks.

When "All networks" is selected for a peer, all MX-Z appliances in the organization will connect to that peer. When a specific network tag or set of tags is selected, only networks that have one or more of the specified tags will connect to that peer.

I am not a Cisco Meraki employee. My suggestions are based on documentation of Meraki best practices and day-to-day experience.

Please, if this post was useful, leave your kudos and mark it as solved.