How do I set up site-to-site VPN between a QuWAN and Cisco® Meraki® device?

Applicable Products

• QuWAN Orchestrator
• QuRouter 2.4.0 and later versions
• Cisco® Meraki® device

Details

This guide details the steps to establish a site-to-site VPN connection between a QuWAN device and a Meraki® MX64 security appliance. While the Cisco® ecosystem offers various devices with site-to-site VPN functionality, this tutorial will specifically focus on the Meraki® MX64 for demonstration purposes.

Procedure

Site-to-site VPN configuration on the Cisco® Meraki® device

1. Sign in to the configuration interface of the Meraki® MX64.
2. Navigate to Security & SD-WAN > Configure > Site-to-site VPN page.
3. Under Non-Meraki VPN peers, click Add a peer and enter the following information:
   • Enter a descriptive name (e.g., QuWAN Site-to-Site VPN)
   • Select IKEv2 as the IKE version.
4. Click Default under IPsec policies and configure the following:
   

   Setting	User Action	Example Value
   Phase 1
   Encryption	Select an encryption method.	AES-128
   Authentication	Select the hash function.	SHA-256
   Pseudo-random Function (PRF)	Select the hash PRF.	SHA-256
   Diffie-Hellman group	Specify the DH group.	14
   Lifetime	Specify the connection lifetime (seconds).	28800
   Phase 2
   Encryption	Select the encryption method	AES-128
   Authentication	Select the hash function	SHA-256
   PFS group	Specify the PFS group	14
   Lifetime (seconds)	Specify the data transfer lifetime (seconds)	3600

   
5. Enter the following information for the remote gateway:
   • Public IP address or hostname of the remote QuWAN device.
   • Specify the internal subnet(s) of the remote site.
   • Enter a strong pre-shared secret key and configure the same key on the remote gateway.
6. Click Save.
   MX64 applies the configuration.

Site-to-site VPN configuration in QuWAN Orchestrator

1. Log in to QuWAN Orchestrator using your QNAP ID credentials.
2. Select your organization.
3. Go to QuWAN Topology > Route-Based VPN.
4. Click Create New Connection.
   The Create New Connection window appears.
5. Configure the route-based VPN connection settings.

   Setting	Description
   Connection name	Assign a descriptive name (e.g., Meraki Site-to-Site VPN).
   IPsec mode	Select Tunnel Mode.
   Hub	Designate the appropriate hub for the connection.
   WAN interface	Enter the desired WAN interface.
   Remote IP or hostname	Specify the public IP address or hostname of the remote gateway device.
   Test Connection (Optional)	Click the button to ping the IP/hostname to confirm the connection.
   Pre-shared key	Establish a strong pre-shared key, ensuring identical configuration on the remote gateway.

6. Configure the advanced route-based VPN connection settings.

   Setting	User Action	Example Value
   Internet Key Exchange (IKE)
   Version	Select IKEv2.	-
   Authentication algorithm	Select a robust authentication algorithm.	AES-128
   Encryption	Select a strong encryption method.	AES-128
   DH group	Select a secure DH group.	14
   Security Association (SA) lifetime	Define the IKE Security Association (SA) duration to reduce cryptographic risks associated with key exposure.	480
   Local ID (Optional)	In the event that a Dynamic DNS (DDNS) service is to be employed for the route-based VPN connection, the local ID must be provided.	-
   Encapsulating Security Payload (ESP)
   Authentication algorithm	Select an authentication algorithm.	SHA-256
   Encryption	Select an encryption method.	AES-128
   Enable Perfect Forward Secrecy (PFS)	Check the box to generate a new DH key.	-
   DH Group	Specify a secure DH group.	14
   Security Association (SA) lifetime	Define the SA lifetime duration.	60 minutes
   Enable Dead Peer Detection (DPD)	Check the box to identity and respond to peer device outages.	-
   DPD timeout	Specify the DPD timeout value..	10 seconds

7. Next to Enable NAT mode, select the checkbox to ensure that the VPN connection functions properly even when NAT devices are present in the network.
8. Specify the local tunnel IP address to facilitate NAT-traversal.
9. Under Site Subnets, click Add Subnet and define the internal subnet of the remote network you want to access.
10. Click Save.

If the route-based VPN connection is successful, the Status field displays the Connected status.

Further Reading

Meraki® Site-to-Site VPN Settings