MX105 version 18.107.2 - Needing to refresh pages to get them to load

[Robbace]

Hi,

We recently updated from 16.16 to 18.107.2.  Noticed after the update some pages don't load until we refresh them.  This is also affecting our DUO VPN MFA as when the radius server we have reaches out to DUO it times out sometimes. Usually, after you hit the pages once and refresh it to load, it's fine for a while.  Same with DUO... Someone connects to the VPN, and times out.  Tries again then duo connects to its URL from the radius server.

Has anyone else experienced this?

[PhilipDAth]

I haven't seen that problem yet.  What model MX was it on?

If you disable IPS and contenting filtering temporarily does the issue go away?

[Robbace]

Hi,

Thanks for the reply. It's on a new MX 105. Tried disabling IPS and Content filtering. No change.  I spoke with support and they recommend changing Client tracking from MAC to IP.  Going to flip the setting tonight when I can do a reboot.  Layer 3 is handled by non meraki switches, they think that's gooping it up.

[PhilipDAth]

I assume DNS is still working ok?  You can use nslookup and get responses promptly?

If you go into developer mode in Chrome (CTRL+SHIFT+I) and look at the network tab, does it show any errors when trying to load the web pages?

[Robbace]

Good advice!

nslookup retrives instantly.

Developer mode just shows it waiting for a response. After about 15 seconds it kicks in 😕

Odd issue.  Once site loads it kicks along fine.  Just that first reach out.

[RaphaelL]

It is the third time I'm seeing Support asking to switch to MAC to IP tracking. I have no idea what the hell is the relation with client tracking and those slowness 

[BlakeRichardson]

It sounds like a browser cache issue. What happens if you try incognito mode? 

[JF1]

I have a very similar problem on 18.107.2 across different hardware. DNS resolves instantly, able to ping all destinations however browsing fails and Meraki support have also asked me "to change the client tracking via IP address".

If we revert to firmware version 16.x.x we dont have the issue. Just awaiting approval from the business to make the change and upgrade again.

[PhilipDAth]

I was just thinking about some of the steps in this process.

I have DNS over HTTPS (DoH) disabled in my browser.  Have you got it enabled in your browser?

Here are the instructions to turn off "Secure DNS" in Chrome:
https://support.google.com/chrome/answer/10468685?hl=en&co=GENIE.Platform%3DAndroid 

[PhilipDAth]

If you download with something not a browser (wget, curl, python, etc) do you still get the issue?

[Robbace · Accepted solution]

Looks like changing the Client tracking to IP fixed the issue for us.  Pages all load without needing to refresh.  Note: Our layer 3 routing down stream is handled by Non-Meraki switches. 

[JF1]

We also made the change last night and it rectified our issue. Worth mentioning if you are using "combined" networks, Tracking via IP is not supported. The network will need splitting first.