Skip to content
DnsLister Forum

Where domain hunters compare notes

Express 7 site-to-site VPN not connecting to Meraki

I just got an Express 7 (currently running UniFi OS 5.1.19) and am having trouble getting my home office connected to my workplace. At work, I have a Meraki network. I have it set up to do site-to-site VPN in hub mode. I have the networks I need to connect to enabled. I created a peer. I'm using IKEv2. The peer's hostname is my dynamic DNS hostname. Local ID and Remote ID are blank. I've tried multiple shared secrets and used copy and paste to ensure they're the same on both sides. Routing is static. All networks are available. In both Phase 1 and Phase 2, I set encryption to AES 256, Authentication to SHA256, and DH to 14 with default lifetimes.

On the Ubiquiti side, everything matches. Same authentication type and pre-shared key, same address, same encryption settings, same subnets. I get the error message, "The remote gateway is not reachable. Verify that the remote address and pre-shared key are correct." I'm able to connect my computer to client VPN with the same address, which is the hostname provided by Meraki. I've tried changing to the IP address of the currently active interface on the Meraki and get the same result. It responds to ping by hostname and IP address. When I look at the logs page on my Express 7, I see nothing related to VPN. I have successfully set up a VPN server on it but none of this shows anything in the logs.

Q1: What am I doing wrong with the site-to-site VPN? How can I get this to connect?

Q2: How do I get VPN activity to show up in the log so I can see what is going on?

Update: My computer connects to client VPN when I remove the peer from the Meraki's site-to-site settings. This makes sense to me. I can understand a single IP having to work as either a client or a site. This confirms that the Meraki is listening and I know the key is correct, so the error message doesn't make sense.

Source: r/Ubiquiti · by /u/WetMogwai

Leave a Reply

Your email address will not be published. Required fields are marked *