Thanks very much for the reply. So this is a bit confusing to me (sorry) since the SD-Wan location is *supposed* to be part of the LAN. We are using "single LAN setting" as well, but I think as you said they are still technically separate networks? It looks like it because I see what you mean about needing to authorize the cloud users separately.  ... View more

Trying to figure out what is going on, I started disabling WAN interface (I have/had 2 connections at each location; fiber and cable at LAN and fiber and cable at SD-Wan location). After disabling one of the WAN interfaces at the SD-Wan location, I was unable to VPN back in there to continue testing. Looking further, I saw that the SD-Wan VPN tunnel is for some reason trying to connect to the backup/failover/WAN 2 IP address at the LAN location. I also noticed that the IPv6 status is "failed" for WAN2 at the LAN location. I'm going to try to unplug the LAN WAN2 interface and see what happens.  ... View more

Thanks for the reply. That IP address does not appear in the ARP table on either appliance (the SD-Wan spoke nor LAN hub).  ... View more

Thanks for the reply.   Yes, these clients are set to use the Umbrella appliances for DNS via DHCP. Although, setting DNS to any of the other DNS servers manually (or using them for nslookup) yields the same result. However, all of the DNS servers including the appliances return answers to non-local queries (e.g. google.com), they are only failing to return internal domain names. I can reach the internal resources via IP address though (e.g. internal file share and https server; I can even ssh to the dns appliances from the clients using their IP address).    Tried both FQDN and short. nslookup for the domain itself fails as well (these are all Windows 10 machines domain joined).  ... View more

Thanks for the reply. I am able to ping the dns servers via ip address but not via dns name. However nslookup does not work at all neither with server name nor IP address. Specifically, I keep getting UnKnown: can't find <name>: Non-existent domain errors when trying nslookup.   Looks like there was an update over the weekend (I have the MX's set to auto-update (stable) on weekends). It's now running 18.211.3. Doesn't sound like the update/reboot fixed the issue; everyone in the office is reporting the same problem. They can connect to WiFi and VPN in, but the SD-Wan is only allowing them to access the internet.   I'm watching the firewall log and there isn't anything being blocked. Is there something specific I should be looking for? I can also see traffic to the DNS server being allowed.    On the Tools page, on DNS lookup, I can lookup the local domain with DNS server set as ip address, but not domain.       Any other tips would be appreciated.   ... View more

It seems like it's an issue with people being on the same WiFi network--something with the way Meraki SecureClient handles the networking--for some reason the first one to connect wins then anyone else trying just fails. It also seems like once multiple people try, if the first disconnects, they cannot connect again. I never did find a solution. I was trying to use IPSec, but had a lot of trouble with that on our Macs too which is why we were forced to use AnyConnect, but if you can get IPSec working, that might solve the issue.    Just curious: what equipment are the WiFi users connecting through? Here we are using Ubiquiti. Wondering if it might be them.   Sorry couldn't be more helpful.  ... View more

They authenticate via Meraki Cloud username and pass. Again, that doesn't seem to be the issue because as mentioned, the first user to connect connects fine. I'm wondering now if the issue was that they were all using the same WiFi. If for some reason because they were on the same wifi thereby the same public IP, if Meraki does some magic behind the scenes for NAT'ing or something that would cause multiple connections from the same public ip via L2TP to not work?   Thanks for the help.  ... View more

It has a public IP address. They are connecting to vpn.example.com which is CNAME'd to the Hostname abc-xyz.dynamic-m.com listed in the Appliance settings.    I'm wondering now if the issue was that they were all using the same WiFi. If for some reason because they were on the same wifi thereby the same public IP, if Meraki does some magic behind the scenes for NAT'ing or something that would cause multiple connections from the same public ip via L2TP to not work?   Thanks for the reply.  ... View more

There are some logs like this (note, 1.1.1.1 is WAN ip, 8.8.8.8 is client ip):       Jun 26 14:37:31 Client VPN Client VPN negotiation msg: <l2tp-over-ipsec-1|24658> CHILD_SA net-ipv4-1{24234} established with SPIs ccfc10d7(inbound) 093852d7(outbound) and TS 1.1.1.1/32[udp/l2f] === 8.8.8.8/32[udp/51365] Jun 26 14:37:30 Client VPN Client VPN negotiation msg: <l2tp-over-ipsec-1|24658> IKE_SA l2tp-over-ipsec-1[24658] established between 1.1.1.1[1.1.1.1]...8.8.8.8[10.1.1.118] Jun 26 11:22:27 Client VPN Client VPN negotiation msg: <l2tp-over-ipsec-1|24463> deleting IKE_SA l2tp-over-ipsec-1[24463] between 1.1.1.1[1.1.1.1]...8.8.8.8[10.1.1.176] Jun 26 11:14:37 Client VPN Client VPN negotiation msg: <l2tp-over-ipsec-1|24463> CHILD_SA net-ipv4-1{24119} established with SPIs c33252da(inbound) 03ff14b1(outbound) and TS 1.1.1.1/32[udp/l2f] === 8.8.8.8/32[udp/59218] Jun 26 10:46:40 Client VPN Client VPN authentication msg: Remote Client IP 8.8.8.8 sent termination request (Peer not responding) Jun 26 10:46:37 Client VPN Client VPN authentication msg: Remote Client IP 8.8.8.8 sent termination request (Peer not responding)   The reason I was thinking it might be DHCP is that the first client that tries seems to connect without issue. It's the subsequent users who get rejected. The users are all in the office today so were trying on our WiFi (which is totally isolated from Meraki--i.e. not connected in any way except when VPN is connected).   Interestingly, when I check the client list, I do not see any of these clients at all. Not even the one that connected first and seemed to be working fine. There is not one entry in the clients list with an ip address that matches the subnet set for the Client VPN.   NB: I have installe secure client on all of their machines and that is working fine...I was hoping to avoid that but I couldn't wait any longer to get them connected.    ... View more

Thanks.   The send all traffic option is and has been set. Like I said, it was working fine until multiple people tried connecting at the same time. ... View more

I was hoping not to since it installs the socket filter and other stuff but I may have to resort to it if I can't get L2TP working.    Thanks for the reply. ... View more

Thanks, good to know.  We are running MX at both location (95 at hub and 68 at spoke), with MS-120 switches going out to the clients. I'm getting the service through AT&T so I don't have full admin access unfortunately and I don't see anywhere where I can see utilization of CPU/RAM etc. the only charts I can see I have posted elsewhere in this thread. It doesn't look like it's using much on the traffic analytics pages, very little jitter and loss.  ... View more

Thanks for the reply.   I have done local copies to test and get on average 100+MB/sec file copy speeds on the LAN between the server and same model laptops as are in use at the spoke.  The spoke is an MX-68, and the utilization is very low (only 7-8 users) despite tunnel all mode.  ... View more

Thanks for the reply. No, everything that can be has been turned off including AMP, IDP, and traffic shaping. I did try adding Windows File sharing, setting the priority to high, but left DSCP tag alone but it didn't make a difference.  ... View more

Thanks for the reply.   I'm running 18.208 at both sites. The devices are set to auto-update on weekends, and this has been happening since I got the service around the new year (it took a while for the complaints to filter up and I was remoted in to a spoke machine and tried to copy a file and saw the awful speeds) at least the last couple of versions. It is scheduled to update to 18.211 next Sunday it looks like.    I ran a speed test at the spoke directly on the Verizon equipment and it gave ~858/847. I do not have Verizon at the Hub--I have dedicated 1Gb fiber. It gives 836/869 directly connected to the MX-98.  ... View more

Thanks, yes, iperf3. Yes, those are the commands I ran (among others). The default settings (using just -c and -s) I get about the same rate--~3Mbps. ... View more

Thanks for the reply.   Are those windows file transfers? You said SMBv2 so I'm assuming yes, but just want to be extra clear.   Testing at all times and it never changes. This is a typical graph on our MX-95 (Hub):     I think MPLS line is the real differentiator here; we don't even have DIA at the spoke (but was looking into it). I don't understand why it would be different for MPLS if you are still using SD-Wan, you would think that whatever was causing my issue would happen on a MPLS link if SMB was really to blame. I'm looking into Private Line now. I hate to spend the money, but this has been going on for a few months now and I have not been able to get it solved.  ... View more