Configure A Site-to-Site VPN between Meraki and Oracle Cloud
By: I Yam Who I Yam
Tags: Oracle Cloud, Oracle, VPN, Meraki

Photo by Petter Lagson on Unsplash

WARNING: Oracle Cloud does not support using Meraki equipment for your VPN. This article is solely a proof-of-concept. Do not follow these steps in a production environment!

This simple tutorial walks you through using your Meraki MX Security Appliance to create a Site-to-Site VPN connection between an Oracle Cloud VCN (Virtual Cloud Network).

This tutorial assumes that:

You have a Meraki MX that is not behind NAT

behind NAT Your MX is already set up to access the internet

No firewall rules are needed for internet access

You have administrator access to the Meraki Dashboard

You have sufficient access to Oracle Cloud

If your Oracle Cloud VCN is already setup, its address block does not interfere with any of your Meraki VLANs

Prepare Oracle Cloud

First, we need to prepare our Oracle Cloud Resources. If you have nothing in Oracle Cloud, you can follow

Creating a new VCN

If you’re starting fresh.

Go to the Virtual Cloud Networks page in the Oracle Cloud Console (Side menu, Networking, Virtual Cloud Networks) Click on Networking Quickstart Choose VCN with VPN Connect and Internet Connectivity Enter a solution name and choose a compartment Enter your MX’s public IP in the CPE Public IP Address field Choose Static Routing In the Static Routes to your on-premises network, enter each Meraki VLAN CIDR block you want to enable VPN connectivity for Leave the Inside/Outside tunnel interface fields blank Choose any CIDR block, but make sure that it does not interfere with any of your Meraki VLANs Click through the rest of the pages and create the solution Navigate to the IPSec Connections page (Side Menu, Networking, IPSec Connections) Continue when your IPSec connections are done provisioning

Adding resources to a VCN

If you’re already set up on Oracle Cloud and just want to add Meraki VPN to an existing VCN. If you’ve already completed any of these steps, just skip them.

Create a Dynamic Routing Gateway and link it to your VCN Create a Customer Premises Equipment (CPE) with your MX’s Public IP address Create an IPSec Connection using Static Routes, where your CPE IKE Identifier is your MX’s Public IP (use IKEv1 at this time, if asked)

Add a rule for your VCN Security List

Navigate to your VCN Security List, and add an ingress rule from every Meraki VLAN CIDR Block you selected. If you don’t do this, traffic will not be able to flow from Meraki into Oracle Cloud.

Make sure there’s something to ping

If there’s nothing configured in your Oracle VCN, add an Always Free tier VM just so that there is something we can ping/SSH into to ensure connectivity.

Final Check for Oracle Cloud

Before we move to Meraki, make sure you know what these things are:

The IP Address and shared secret to one of your IPSec Connections

Your VCN CIDR Block (the whole thing — not a subnet)

The CIDR Blocks listed in your IPSec Connection

Also, make sure you allow ingress from your Meraki CIDR Blocks to your VCN.

Configure Meraki

We can now configure our MX to connect to our VCN.

Open the Meraki Dashboard Navigate to the Site-to-Site VPN settings page (Security & SD-WAN, Site-to-site VPN Select Hub (Mesh) as the type Enable the VPN only for subnets listed in your IPSec connection — having one too few or one too many will cause the entire connection to fail

Add a Non-Meraki VPN Peer

Give it a name

Set the Public IP to the Public IP of your IPSec Connection in Oracle Cloud

Leave Remote ID blank

Set Private subnets to the CIDR Block of your entire VCN

Set IPSec policies to custom, and follow the configuration below:

Meraki IPSec policies for connecting to Oracle Cloud

Fill in your Preshared secret from Oracle Cloud

Set Availability to all networks

You will notice that there are two IPSec Tunnels from Oracle’s side. Meraki only supports connecting to one at a time. Ensure all of your settings are consistent for one tunnel as they have different Preshared secrets and IP addresses.

Connection test

We’re all done provisioning, and you should now be able to ping something inside of your VCN.

If you’re having trouble, either leave a comment or call Meraki support. The MX Event Log is too chatty to really understand what a problem is — I have hundreds of events drop per second when using it.