What are two ways peers interact with ports that Auto VPN uses? (Choose two.)

Cisco Meraki's Auto VPN feature relies on two primary communication paths. First, Meraki MX peers must contact the cloud-based VPN registry to learn the IP address and port information of other peers in the organization. This orchestration traffic occurs over UDP port 9350 (and 9351). Second, once peers have the necessary information, they establish a direct IPsec tunnel between each other. The encapsulated VPN traffic for this peer-to-peer tunnel uses a high-numbered UDP port, typically within the ephemeral range of 32768 to 61000. These two mechanisms—cloud orchestration and direct peer tunneling—are fundamental to how Auto VPN functions.

C. IPsec tunnels for Auto VPN use UDP for encapsulating traffic to optimize performance and handle NAT traversal; TCP is not used for the data plane.
D. Communication with the Meraki VPN registry for Auto VPN orchestration is connectionless and uses UDP, not the connection-oriented TCP protocol.
E. While standard IPsec uses UDP ports 500/4500 for IKE negotiation, Meraki Auto VPN specifically uses high UDP ports for the established peer-to-peer data tunnel.

1. Cisco Meraki Documentation, "Upstream Firewall Rules for Cloud Connectivity." This official document explicitly lists the required ports for Meraki device operation.

Under the "Site-to-site VPN" section, it specifies:

VPN registry: Protocol: UDP, Ports: 9350-9351. This supports the correctness of option B.

Site-to-site VPN: Protocol: UDP, Ports: 32768-61000. This supports the correctness of option A.

2. Cisco Meraki Documentation, "Auto VPN - Site-to-site VPN." This guide details the functionality of Auto VPN.

In the "Auto VPN Technology" section, it states, "The MX security appliance uses UDP port 32768-61000 for sending and receiving VPN traffic to other MX security appliances." This directly confirms the port range used for peer-to-peer IPsec tunneling.