Third-Party VPN Peers Configuration

Dashboard Location: Security and SD-WAN > Configure > Site-to-site VPN > Organization-wide settings

Third-party VPN peers configuration in Meraki organizations enables secure connectivity with external VPN gateways from cloud providers, partner organizations, and non-Meraki network equipment. This functionality supports IPsec-based connections with customizable encryption policies, authentication methods, and network routing for hybrid cloud deployments and multi-vendor network integration. Third-party VPN peers are essential for organizations requiring connectivity with AWS, Azure, Google Cloud, or other external networks while maintaining centralized management and consistent security policies.

Example-1: The example below demonstrates third-party VPN peers configuration.

This configuration establishes secure connections with external VPN gateways including cloud providers and non-Meraki equipment. The example includes IPsec policies, authentication settings, encryption parameters, and routing configurations for hybrid cloud and multi-vendor network integration.

The first VPN peer (“AWS VPN 01”) exemplifies simplified cloud integration using “public_hostname: vpn.example.com” for FQDN-based connectivity (supporting dynamic IP resolution), “private_subnets” arrays defining accessible networks behind the remote gateway (192.168.1.0/24, 192.168.2.0/24), and robust authentication through “local_id: 192.168.128.10” and “remote_id: 1.1.1.2” for IPsec identity verification. The configuration employs “ipsec_policies_preset: aws” for AWS-optimized encryption settings (eliminating manual policy configuration), “secret: supersecretkey” for pre-shared key authentication, “ike_version: 2” for modern IKEv2 protocol support with enhanced security and performance, and “network_tags” (Production, VPN) for organizational classification and policy application.

The second peer (“AWS VPN 02”) demonstrates granular IPsec policy customization using “public_ip: 1.1.1.100” for static IP connectivity, while implementing detailed “ipsec_policies” with Phase 1 IKE parameters including “ike_cipher_algo: aes128” for encryption, “ike_auth_algo: sha256” for authentication hashing, “ike_prf_algo: prfsha256” for pseudo-random function, “ike_diffie_hellman_group: group14” for key exchange (2048-bit MODP group), and “ike_lifetime: 3600” seconds for security association duration. Phase 2 IPsec parameters mirror Phase 1 with “child_cipher_algo: aes128”, “child_auth_algo: sha256”, “child_pfs_group: group14” for Perfect Forward Secrecy, and “child_lifetime: 3600” for data encryption key refresh intervals, ensuring optimal security posture and compliance with enterprise cryptographic standards.

meraki:
  domains:
    - name: "!env domain"
      administrator:
        name: "!env org_admin"
      organizations:
        - name: "!env org"
          appliance:
            third_party_vpn_peers:
              - name: AWS VPN 01
                public_hostname: vpn.example.com
                private_subnets:
                  - "192.168.1.0/24"
                  - "192.168.2.0/24"
                local_id: "192.168.128.10"
                remote_id: "1.1.1.2"
                ipsec_policies_preset: aws
                secret: "supersecretkey"
                ike_version: "2"
                network_tags:
                  - "Production"
                  - "VPN"
              - name: AWS VPN 02
                public_ip: 1.1.1.100
                private_subnets:
                  - "192.168.1.0/24"
                  - "192.168.2.0/24"
                local_id: "192.168.128.100"
                remote_id: "1.1.1.200"
                ipsec_policies:
                  ike_cipher_algo:
                    - aes128
                  ike_auth_algo:
                    - sha256
                  ike_prf_algo:
                    - prfsha256
                  ike_diffie_hellman_group:
                    - group14
                  ike_lifetime: 3600
                  child_cipher_algo:
                    - aes128
                  child_auth_algo:
                    - sha256
                  child_pfs_group:
                    - group14
                  child_lifetime: 3600
                secret: "supersecretkey"
                ike_version: "2"
                network_tags:
                  - "Production"
                  - "VPN"