MR loses connection between Meraki dashboard periodically - but service keeps going on

[Kamome]

I have a network with one MX65 and two MR36s.

AutoVPN is full-tunnel mode, so MR36 uses IDC's Internet connection.

Since initial install, MR36 keeps losing connection between Meraki dashboard for 2 hours, then back on for 2 hours, and losing for 2 hours again, and keeps repeating.

Initially, MX65's firmware version was 15.42.1, so I upgraded it to 15.44(latest stable).

After that, it seems bit better, but still doing flip-flopping. (MR36's version is MR28.5)

Surprisingly, user have no issues with wireless, and on-premise NMS which checks devices' availability via ping reports no problem with MR.

Even other network which is in same Organization and using MR36 have no problem with Meraki dashboard connection.

I'm running several MX65/68 and MR33/36 combos, but seems only MX65 + MR36 have problem.

Is this can be hardware or software problem?

[Ryan_Miles]

I found the Support case you recently opened on this. I can see these APs are actually rebooting many times a day leading to the red patches you see on the timeline. Also, they're not actually running 28.5. For some reason they're still running a much much older firmware release.The firmware update is failing which is causing the constant upgrade attempt and reboots.

My advice is lean on Support to ensure these get the proper firmware and that should stabilize them. Also, 28.6 just hit RC status today so I would actually recommend using that version.

[Kamome]

Oh, so it was firmware update problem.

I'll check support case and trying to go RC firmware. Thanks.

[Ryan_Miles]

Yeah, I can see it's trying to upgrade, failing, rebooting over and over. I believe Support has the power to force an upgrade through. I've seen this happen a few times over the years although never on APs.

[Kamome]

I've seen this problem on MX several times, and most of them can upgrade firmware properly after manual rebooting. Plus, in that case, I can see firmware upgrading message on Local status page. But I cannot see any of these messages on MR.

[BlakeRichardson]

@Kamome Can you plug the MR into a different internet connection thats not routing through a VPN tunnel and see if they update successfully? 

[Kamome]

For now, there are no way to connect MRs to another Internet connection. To do that, I have to disable VPN on the site.

But I'll try it if forced firmware upgrade is failed. Thanks.

[Kamome]

Update : I got answer from TAC, and they said that some kind of SSL inspection on on-premise side is rejecting MR's SSL certificate because it's "unknown CA". And it seems recently updated firmwares(MX/MS/MR) are all using SSL certificate.