Cisco Meraki Virtual MX with AWS Cloud WAN on AWS

Partner Solution Deployment Guide

QS

August 2022
Simarbir Singh, Cisco Technical Marketing Engineer, Cisco Systems, Inc.
Josh Leatham, AWS Partner Solutions Architect
Shivansh Singh, AWS Integration & Automation team

Refer to the GitHub repository to view source files, report bugs, submit feature ideas, and post feedback about this Partner Solution. To comment on the documentation, refer to Feedback.

This Partner Solution was created by Cisco Systems, Inc. in collaboration with Amazon Web Services (AWS). Partner Solutions are automated reference deployments that help people deploy popular technologies on AWS according to AWS best practices. If you’re unfamiliar with AWS Partner Solutions, refer to the AWS Partner Solution General Information Guide.

Overview

This Quick Start deploys Cisco Meraki Virtual MX with AWS Cloud WAN on the AWS Cloud. This guide covers the steps necessary to deploy this Quick Start.

CW_Overview
Figure 1. Meraki vMX overview

This Quick Start helps automate the deployment of Meraki vMXs in multiple AWS Regions along with route propagation and high availability. Using Meraki AutoVPN, you can connect multiple Meraki branch MXs to AWS regional virtual MX (vMX) hubs configured in an active-active pair. All routes learned via AutoVPN are propagated into AWS for a more seamless connectivity from your branch locations to your AWS workloads in any AWS Region. This deployment combines AWS Cloud WAN, Meraki APIs, and a serverless mechanism for distributing routes without using Border Gateway Protocol (BGP). For a high-level overview, refer to Automating a Global Meraki Deployment in Multiple AWS Regions.

Costs and licenses

This deployment is not a Meraki vMX warm spare configuration. It requires you to have at least two Meraki vMX licenses. If your organization has already reached its license limit, you cannot create new Meraki vMX networks until a Meraki vMX network is deleted or additional licenses are added. For more information, refer to Add Another License. If you do not have access to a Meraki vMX license or require additional Meraki vMX licenses, reach out to your Meraki reseller or sales representative.

There is no cost to use this Quick Start, but you will be billed for any AWS services or resources that this Quick Start deploys. For more information, refer to the AWS Quick Start General Information Guide.

Architecture

Deploying this Quick Start with default parameters builds the following Meraki vMX environment in the AWS Cloud.

Architecture
Figure 2. Quick Start architecture for Meraki vMX on AWS

As shown in Figure 2, this Quick Start sets up the following:

  • Two highly available transit VPCs in two separate AWS Regions.*

  • In each VPC, two Availability Zones that contain a Meraki vMX appliance with internet access via an internet gateway (not shown).

  • An AWS Cloud WAN core network that includes the following:

    • A core network policy that includes the routing policy (not shown).

    • A software-defined wide area networks (SD-WAN) segment that can be integrated into customer-provided workload segments (not part of Quick Start). Routes from each Meraki vMX branch connected via the transit VPCs are propagated throughout the SD-WAN segment for sharing with additional workload segments.

    • For each Region deployed, an AWS Cloud WAN core network edge for connecting workload VPCs to the transit VPC.

  • Amazon Step Functions state machine to orchestrate API calls that update the Cloud WAN core network policy with additional branch routes as they are discovered in the Meraki vMX dashboard.

  • Amazon EventBridge to send events from each Region to the Step Functions state machine when updates are needed.

  • AWS Secrets Manager to store a Meraki vMX API key, which is used by AWS Lambda to access the Meraki dashboard when updating route tables.

  • AWS Lambda to accompany Step Functions when updating the core network policy.

* The template that deploys this Quick Start into an existing VPC skips the components marked by asterisks and prompts you for your existing VPC configuration.

Deployment options

This Quick Start provides the following deployment options:

  • Deploy Meraki vMX into a new VPC. This option builds a new AWS environment that consists of the VPC, subnets, NAT gateways, security groups, bastion hosts, and other infrastructure components. It then deploys Meraki vMX into this new VPC.

  • Deploy Meraki vMX into an existing VPC. This option provisions Meraki vMX in your existing AWS infrastructure.

This Quick Start provides separate templates for these options. It also lets you configure Classless Inter-Domain Routing (CIDR) blocks, instance types, and Meraki vMX settings.

Predeployment steps

This Quick Start assumes familiarity with the Meraki dashboard and setting up a vMX appliance on AWS. For more information, refer to vMX Setup Guide for Amazon Web Services (AWS).

Prepare your AWS account

Subscribe to the Meraki vMX AMI

This Quick Start requires a subscription to the Amazon Machine Image (AMI) for Meraki vMX in AWS Marketplace.

  1. Sign in to your AWS account.

  2. Open the page for the Cisco Meraki vMX AMI in AWS Marketplace, and then choose Continue to Subscribe.

  3. Review the terms and conditions for software usage, and then choose Accept Terms.
    A confirmation page loads, and an email is sent to the account owner. For detailed subscription instructions, refer to the AWS Marketplace documentation.

  4. When the subscription process is complete, exit out of AWS Marketplace without further action. Do not provision the software from AWS Marketplace—the Quick Start deploys the AMI for you.

Prepare your Meraki vMX account

  1. Complete the instructions in the Meraki Dashboard Configuration section of the vMX Setup Guide for Amazon Web Services (AWS). During configuration, you generate authentication tokens for the vMX appliances. Copy and save the tokens. You must enter them in the vMX1Token and vMX2Token parameters in the AWS CloudFormation console during Quick Start deployment.

    generate_auth_token
    Figure 3. Generating authentication tokens

  2. For each template deployed, for both the base and additional Region parameters, set the network tag of vMXn to identify vMX nodes as the primary and secondary hub, respectively. To set network tags in the Meraki dashboard, refer to Manage Tags.

    Perform this step at the global dashboard level, and not on the vMX Network tab.
    meraki_tags
    Figure 4. Setting tags

  3. Configure your branch sites as Meraki Auto VPN spokes with the vMX instances as the primary and secondary hubs. For more information, refer to Meraki Auto VPN - Configuration and Troubleshooting.

    1. Add a summary route on each vMX that includes a summary CIDR range of all AWS resources in all Regions. Optionally, you can use multiple CIDRs for non-contiguous addresses.

    2. Optionally, advertise the local transit VPC subnet, if needed.

      meraki_vpn
      Figure 5. VPN settings

Deployment steps

  1. Sign in to your AWS account, and launch this Partner Solution, as described under Deployment options. The AWS CloudFormation console opens with a prepopulated template.

  2. Choose the correct AWS Region, and then choose Next.

  3. On the Create stack page, keep the default setting for the template URL, and then choose Next.

  4. On the Specify stack details page, change the stack name if needed. Review the parameters for the template. Provide values for the parameters that require input. For all other parameters, review the default settings and customize them as necessary. When you finish reviewing and customizing the parameters, choose Next.

    Unless you’re customizing the Partner Solution templates or are instructed otherwise in this guide’s Predeployment section, don’t change the default settings for the following parameters: QSS3BucketName, QSS3BucketRegion, and QSS3KeyPrefix. Changing the values of these parameters will modify code references that point to the Amazon Simple Storage Service (Amazon S3) bucket name and key prefix. For more information, refer to the AWS Partner Solutions Contributor’s Guide.

  5. On the Configure stack options page, you can specify tags (key-value pairs) for resources in your stack and set advanced options. When you finish, choose Next.

  6. On the Review page, review and confirm the template settings. Under Capabilities, select all of the check boxes to acknowledge that the template creates AWS Identity and Access Management (IAM) resources that might require the ability to automatically expand macros.

  7. Choose Create stack. The stack takes about 30 minutes to deploy.

  8. Monitor the stack’s status, and when the status is CREATE_COMPLETE, the Cisco Meraki Virtual MX with AWS Cloud WAN deployment is ready.

  9. To view the created resources, choose the Outputs tab.

Postdeployment steps

Verify Cloud WAN resources

  1. In the Step Functions console, verify that the CreateStateMachine and CreateNetworkNewRegion APIs ran successfully. These actions run once per template.

    sf_verify
    Figure 6. Verify Step Functions workflow

  2. In the Network Manager console, verify that Cloud WAN contains a global network, a core network, and a VPC attachment.

    global_network
    Figure 7. Global network
    core_network
    Figure 8. Core network
    vpc_attachment
    Figure 9. VPC attachment

Add VPC summary route to Cloud WAN VPC attachment

For the transit VPC to route traffic to your Cloud WAN backbone, you must have one or more routes for the IP address range of your AWS workloads across the various deployed Regions. . Pick an IP CIDR range that differentiates your AWS resources from your branch and on-premise resources. . Point the route to the core network’s VPC attachment for the transit VPC. For more information, refer to Configure route tables.

+

vpc_route
Figure 10. VPC route

  1. Optionally, add workload VPCs from different Cloud WAN segments into your core network policy. If you have workloads in separate Cloud WAN segments, you can advertise those routes to your Meraki SD-WAN vMXs via the core network policy. For more information, refer to Introducing AWS Cloud WAN (Preview).

Deploy transit VPC in a different Region

Ensure that you are in a different Region than the one used in the original deployment (referred to as the base Region).

  1. Deploy the transit VPC in a new Region. This template also deploys a polling Lambda function to check and configure additional routes.

  2. In the upper-right corner of the navigation bar, choose an additional AWS Region that’s different from the base Region.

  3. On the Create stack page, keep the default setting for the template URL, and then choose Next.

  4. On the Specify stack details page, change the stack name if needed. Review the parameters for the template. Provide values for the parameters that require input. For all other parameters, review the default settings and customize them as necessary. When you finish reviewing and customizing the parameters, choose Next.

  5. On the Configure stack options page, you can specify tags (key-value pairs) for resources in your stack and set advanced options. When you finish, choose Next.

  6. On the Review page, review and confirm the template settings. Under Capabilities, select the two check boxes to acknowledge that the template creates IAM resources and might require the ability to automatically expand macros.

  7. Choose Create stack to deploy the stack.

  8. To view the created resources, see the values displayed in the Outputs tab for the stack.

  9. Verify that the Cloud WAN resources deployed successfully.

    1. In the Step Functions console, verify that the CreateNetworkNewRegion API ran successfully. Note that the CreateStateMachine does not run because it was already created when you deployed the main Quick Start template.

    2. Confirm that a new SD-WAN attachment was created and attached to the additional Region’s transit VPC.

  10. In the Network Manager console, verify that Cloud WAN contains a global network, a ccre network, and a VPC attachment.

  11. Add a VPC summary route to the Cloud WAN VPC attachment by repeating the steps you took earlier for the base Region. At that time, you created a similar summary route from the new transit VPC to the new Cloud WAN VPC attachment.

Troubleshooting

For troubleshooting common Quick Start issues, refer to the AWS Quick Start General Information Guide and Troubleshooting CloudFormation.

Customer responsibility

After you deploy a Partner Solution, confirm that your resources and services are updated and configured—including any required patches—to meet your security and other needs. For more information, refer to the Shared Responsibility Model.

Feedback

To submit feature ideas and report bugs, use the Issues section of the GitHub repository for this Partner Solution. To submit code, refer to the Partner Solution Contributor’s Guide. To submit feedback on this deployment guide, use the following GitHub links:

Notices

This document is provided for informational purposes only. It represents current AWS product offerings and practices as of the date of issue of this document, which are subject to change without notice. Customers are responsible for making their own independent assessment of the information in this document and any use of AWS products or services, each of which is provided "as is" without warranty of any kind, whether expressed or implied. This document does not create any warranties, representations, contractual commitments, conditions, or assurances from AWS, its affiliates, suppliers, or licensors. The responsibilities and liabilities of AWS to its customers are controlled by AWS agreements, and this document is not part of, nor does it modify, any agreement between AWS and its customers.

The software included with this paper is licensed under the Apache License, version 2.0 (the "License"). You may not use this file except in compliance with the License. A copy of the License is located at https://aws.amazon.com/apache2.0/ or in the accompanying "license" file. This code is distributed on an "as is" basis, without warranties or conditions of any kind, either expressed or implied. Refer to the License for specific language governing permissions and limitations.