palo alto nat across S2S VPN to reach mgmt interface

Customer had 192.168.x.x network overlapping

I needed to reach 192.168.0.82

I decided to NAT on customer side.

I sent traffic to 172.17.19.0 (This was in the VPN proxy ID)

172.17.19.0 (cust side) <> 172.16.100.0 (my side)

Now for NAT

Source Zone: VPN-ZONE (don't forget tunnel interface setup)

Destination zone: LAN

Source add: 172.16.100.0

Destination add: 172.17.19.0

Translated packet

Destination address translation

Translation type: Static IP

Translated address: N-192.168.0.0-24

Also note that mgmt interface IP config is not sync'd so you will need to get your IP's allowed under 

device > setup > interfaces > management > permitted IP addresses 

switch meraki mx to new internet connection

*** Important 

Cisco messed up the local status page passwords. Autogenerated pws but they weren't stored by cisco or given to customers.

Step 1 - Make sure local status page is enabled and pw reset

• Network wide > configure > general 
• Scroll down to Device configuration
• Make sure "local device status page enabled" is selected in the drop down
• Change password, enter a 14 char pw with numbers/upper and lower case and symbol
• Click update
• Allow time for cloud to sync

Step 2 - Test local status page before switching

• Before switching anything 
• Plug laptop into a meraki LAN port (check the port is on right vlan)
• Visit the local status page for MX it should be http://wired.meraki.com
• One customer said it only worked in edge but not chrome 
• test login works

Step 3 - Switch over to new interconnection and reconfig

• Switch over to new internet connection
• Plug WAN port into the new ISP
• Log into local status page. 
• Config the new settings and save
• Give it a few minutes to connect to cloud (check LEDs)
• It should come online and appear in cloud
• You may also change the cloud config to match 

Meraki status pages

MR - http://ap.meraki.com

MS - http://switch.meraki.com 

MX - http://mx.meraki.com or http://wired.meraki.com

MG - http://mg.meraki.com

Any - http://setup.meraki.com or http://my.meraki.com

FYI - Cisco reset local status page passwords, it used to be admin and the serial of the device but in 2025 cisco auto generated one and asked users to set a password.

https://documentation.meraki.com/General_Administration/Tools_and_Troubleshooting/Using_the_Cisco_Meraki_Device_Local_Status_Page