Setup 2 wan interface but when using Flow References no internet traffic coming out on wan2

[GelC]

Hi

I have a concern regarding mx100. we have 2 wan interface. my primary link is wan1. Both wan1 and wan2 are working and tested then each link have different isp provider.

Now here's my concern, I was told that if i want to send a certian ip or subnet to have internet traffic go out to wan2 i just need to set it up on the Flow References -> Internet Traffic. So I did, but unfortunately the internet traffic still goes out to wan1 even if when I check public ip and speedtest.net its showing the wan2 details. The Internet traffic only go out to wan2 when i change the primary link to wan2.   

[alemabrahao]

If you are testing with ICMP it's normal, check the note:

[GelC]

Hi Alemabrahao. Im not testing icmp. I'm actually sending a certain ip/subnet using Flow References -> Internet Traffic to wan2. Then after saving my changes still my internet traffic goes outside wan1 even if i do a speedtest the internet speed reflect on wan1. 

[alemabrahao]

I'm confused, because you sad  "even if when I check public ip and speedtest.net its showing the wan2 details"

[alemabrahao]

On speed test which IP is shown to you from wan1 or wan 2? Check It:

https://documentation.meraki.com/MX/Firewall_and_Traffic_Shaping/MX_Load_Balancing_and_Flow_Preferen...

[GelC]

My load balancing is disable. I dont need the traffic to be spread across both uplink.

[GelC]

Oh sorry for the confusion. So if i use Flow References -> Internet Traffic then sent a certain ip/subnet on wan2 then check using whatsmyip and do a speedtest it will show my wan2 public ip but the internet speed still reflect on wan1. 

[alemabrahao]

Speed test is based on ICMP 🙂

[GelC]

So how do i know or how do i check if my my changes on Flow References -> Internet Traffic is successful if speedtest, traceroute, packet capture is still showing my wan1 ?

[alemabrahao]

If the speed test is showing the WAN2 IP It's ok, all those tests are based on ICMP.

[GelC]

I think its not ok if I'll tell a client that i already sent his ip to wan2 but the result is still showing of a wan1 speed result. 

[alemabrahao]

So, you should open a case with Meraki team support to check It. 🙂

[GelC]

yeah i think i'll do this if i still cant figure this out. thank you Alemabrahao

[alemabrahao]

@GelC , Did you open a similar case 6 hours ago? 

[RaphaelL]

No..... 

It's TCP based

[alemabrahao]

No, ICMP, speed test servers with ICMP. 🙂

[alemabrahao]

• Testing to the same server. Speedtest automatically selects a server to test to based on ping, but you can also select a server to test to.

[RaphaelL]

I get what you are saying. 

The selection is based on ICMP yes.  But the actual test is done on TCP. 

That being said. Since the selection is based on ICMP and ICMP is not subjected to trafic shaping / flow preference , the server will always be selected on WAN1.  

A better test to troubleshoot your flow selection would be to use another website / service. CNN , something like that.

[alemabrahao]

Nope, I'm rigth. 

[GelC]

Hi Raphael. Noted on this. will check on this. Thank you

[alemabrahao]

https://www.speedtest.net/about/knowledge/faq

[RaphaelL]

Have you tried to reboot the MX ? There is probably a flow table that won't get updated until the flow times out / expires. 

[alemabrahao]

@RaphaelL , I think that is not the case. check my answer above.

[RaphaelL]

I had seen your answer. OP didn't mention anything about ICMP... 

[GelC]

Hi Raphael, Yes already did reboot the MX. still same issue. It only change when i set the primary link to wan2. 

[ww]

You are not using autovpn  with a default route ?

What if you run a packet capture on wan2 with filter "port 53". And then start a nslookup to cisco.com froma client.  

Do you see this in the capture?

[GelC]

Hi @ww  will try this one and update you on my finding. thank you for the idea

[PhilipDAth]

Can you post a screenshot of the flow preference you have created, and the internal IP address you are using.

[GelC]

Hi @PhilipDAth here is the screenshot. sorry but i need to shade the internal ip address. My scenario is that when i send the machine ip to the secondary link my internet traffic still go outside to the primary link. but when i check whatsmyip or do a speedtest via speedtest.net or fast.com it is showing my secondary public ip then the speed result is showing on my primary link. 

[alemabrahao]

Your preferred link is configured for the WAN 1 🤔

How is configured your uplink configuration and uplink selection? Take a look at those examples:

[PhilipDAth · Accepted solution]

The preferred uplink only takes affect for new flows.  When you change it you need to make sure the MX has gotten the new config first, and then quit the browser and open it again it make sure it is a new flow.  Even then it might still use a cached flow for the next 10 minutes or so.

[GelC]

Hi @PhilipDAth. Noted on this Thank you for you help.