Configuring a Cisco Meraki vMX Without an IP Address

注意

Cisco Meraki vMX on Network Edge is currently available as a Beta offering only.

A Meraki vMX created Without an Equinix Public IP Address has no internet path of its own. It cannot obtain an IP address or register with the Meraki Dashboard until it is connected to a helper device that provides DHCP and NAT.

This procedure uses a Cisco Catalyst 8000V (Autonomous Mode) as the helper device. The helper has an Equinix public IP address on its WAN interface. The vMX connects to the helper through a device link group, which is a private link inside Network Edge. The helper assigns the vMX an IP address by DHCP and translates the vMX traffic to the helper's public IP address so the vMX can reach the Meraki cloud.

Prerequisites

• A Cisco Catalyst 8000V (Autonomous Mode) license for the helper device. See Cisco Catalyst 8000V (Autonomous Mode).
• Both devices in the same metro and the same Equinix account. Device links within a metro have no connection charge. Device links between metros do.
• An addressing plan for the helper LAN subnet. The example uses 20.1.1.0/24.

important

Do not generate the Meraki Day-0 token until you are ready to create the vMX. The token is valid for one hour.

Deploy the Helper Device

1. Create a Cisco Catalyst 8000V (Autonomous Mode) single device in the same metro where you plan to create the vMX.
2. In the Connectivity section, select With Equinix Public IP Address. The helper needs the public IP address to NAT the vMX traffic.
3. Select the licensing, device resources, software package, throughput, and software version for your design.
4. In the Device Access section, add a username for SSH access.
5. In the Access Control List Templates, select a template that permits SSH from your management address.
6. Create the device and wait for the status to change to Provisioned.
7. Configure DHCP and NAT on the Helper Device

Connect to the Helper Device Using SSH

1. Enter configuration mode and apply the following configuration. Replace the pool name, subnet, and interface names to match your design.

   ip dhcp pool ABC-POOL
    network 20.1.1.0 255.255.255.0
    default-router 20.1.1.1
    dns-server 8.8.8.8
    lease infinite
   !
   ip dhcp excluded-address 20.1.1.1 20.1.1.5
   !
   interface GigabitEthernet5
    ip address 20.1.1.1 255.255.255.0
    ip nat inside
    exit
   !
   interface GigabitEthernet2
    ip nat outside
    exit
   !
   ip access-list standard 7
    10 permit 20.1.1.0 0.0.0.255
   !
   ip nat inside source list 7 interface GigabitEthernet2 overload

2. Save the configuration.

   write memory

3. Confirm the helper device has a default route to the internet and can reach external addresses from its WAN interface.

Create the Meraki vMX

1. Prepare the Meraki Dashboard and generate the Day-0 authentication token.
2. Create the Meraki vMX as described in Cisco Meraki vMX SD-WAN (Beta), but with the following differences:
   • Select the same region and metro as the helper device.
   • In the Connectivity section, select Without Equinix Public IP Address.
   • In the Additional Services section, there is no default internet bandwidth to configure.

The vMX provisions without an internet path. It cannot register with the Meraki Dashboard until you link it to the helper device.

Create the Device Link Group (DLG)

1. From the Network Edge menu, select Device Link Inventory.
2. Click Create New Device Link Group.
3. Select the two devices you created: the Meraki vMX and the Catalyst 8000V helper device.
4. Enter a Device Link Name, set the connection type to Primary, and select the Connection Bandwidth.
5. In the Interface Selection section, select I will select an interface.
   • For the helper device, select the interface you configured as the NAT inside interface (GigabitEthernet5 in the example).
   • For the vMX, select the interface used as its WAN uplink.
6. Review the devices and pricing and click Submit.

Verify the Deployment

1. On the helper device, run show ip dhcp binding. Confirm the vMX has a lease from the helper LAN subnet.
2. Run show ip nat translations. Confirm there are translations from the vMX address to the GigabitEthernet2 public address.
3. In the Meraki Dashboard, select Security & SD-WAN > Monitor > Appliance status. Confirm the vMX is online. Allow about five minutes after the link is active.
4. In the Equinix Customer Portal, confirm both devices are Provisioned and the device link group is active.

Redundant Devices Without a Public IP Address

To create a redundant pair of Meraki vMXs without an IP address:

1. Deploy a helper device and configure DHCP and NAT as described above.
2. Select Redundant Device and your placement option. In the Connectivity section, select Without Equinix Public IP Address.
3. Enter the device details and a separate Day-0 token for each vMX.
4. Create a device link group so that each vMX connects to a helper device. Verify each vMX as described above.

If the pair spans two metros, deploy a helper device in each metro so that each vMX has a same-metro link.

Troubleshooting

If the vMX is not visible in the Meraki Dashboard:

• Token expired - The Day-0 token must be used within one hour of generation. Generate a new token in the Meraki Dashboard.
• Device not provisioned - Confirm the device status is Provisioned in the Virtual Device Inventory.
• ACL blocks required traffic - Review the ACL template applied to the device. For a helper device, make sure return traffic from the Meraki cloud is permitted.
• No DHCP lease (without a public IP address) - Confirm the device link group is active and uses the correct interfaces. Run show ip dhcp binding on the helper device.
• No NAT translations (without a public IP address) - Confirm GigabitEthernet5 is ip nat inside, GigabitEthernet2 is ip nat outside, and the helper device has a default route to the internet. Run show ip nat translations on the helper device.

If the issue persists, open a support case from the Network Edge portal for infrastructure issues. For Meraki software and licensing issues, contact Cisco Meraki.