Meraki

from_afar · ‎May 8 2024

It isn’t always consistent and I’m not an iperf expert. I tried different window sizes and parallel streams. With the default settings for server and client, it does average around the same, though. That said, http downloads over the connection were a bit better (~10-15Mbps). iperf results have been consistent throughout—no faster after support call. Happy to run or share specific tests if you want to see them.

from_afar · ‎May 8 2024

We installed SD-Wan a few months ago in a very simple single vlan spoke and hub setup--just the 2 locations, spoke and hub involved. Both locations has 1000/1000Mbps connections (verified both are getting expected speeds). When we try to copy a file from a Windows 2022 server on the hub to a windows 10 client (all fully patched) on the spoke, the file copy speeds (as well as iperf) peak at about 3Mbps. This makes it very hard for the users to get work done as the files their software uses are usually fairly large so everything takes a long time to open/save and files are getting corrupted regularly. All AMP/IDP services are disabled on the spoke; tunnel all is on as we need all traffic to exit the HUB. We did all of the standard and even standard troubleshooting (disablebandwidththrottling registry edit, SMB tuning on the server, checking MTU, etc.) all to no avail. I went to the spoke location and scheduled a call with support (we get the service through ATT) who got a Meraki tech on the line. We spent 2 hours looking at things and testing with iPerf, testing file copy speeds between 2 machines on the spoke (worked fine) and at the end of it all, the final "answer" from the Meraki tech was that this is expected behavior with SD-Wan and SMB. If this is the case, how do people solve SD-Wan locations using fileshares? It seems like this should be a pretty standard and common setup, but is there really no solution to using SMB over SD-Wan (I confirmed we are using SMB3.1.1; packet captures show SMB2, SMB1 is definitely disabled). I was looking at maybe getting a better connection at the spoke (it is VZN Fios, so Fiber but shared) like DIA, but it's much more expensive and if SD-Wan is incompatible with SMB it wouldn't fix the issue anyway.

from_afar · ‎May 1 2024

Any other ideas would be greatly appreciated.

from_afar · ‎Apr 29 2024

Thanks for the reply, but I'm not sure what that means. The ISP connection is purely for the SD-Wan/Meraki connection--Wi-Fi is on its own isolated network and ISP (cable) both at the hub and spoke if that's what you mean. I.e. the only thing using the ISP connections (Private fiber at Hub, Verizon Fiber at spoke) are the Meraki MX-68 and MX-95.

from_afar · ‎Apr 26 2024

Thanks for the reply. Yeah not sure why the speed test is so slow too--all of our connections are 1Gig...I do get the same file transfer speeds via Secure Client connecting directly to the hub too, so not sure why it seems to be such a problem with Windows File Sharing. I found another thread that had recomended settings for remote fileshares (https://learn.microsoft.com/en-us/windows-server/administration/performance-tuning/role/file-server/) but that didn't help either. I'm really at a loss...

from_afar · ‎Apr 26 2024

Sorry to jump back in here, but another issue has popped up that is probably the cause. For some reason, the users at the SD-Wan location (and if I VPN into that location I see the same thing) are only getting 3-4Mbps file copy speeds MAX. I've turned off all AMP/IDP/Umbrella settings at both locations (spoke and hub) but not matter what I try, I can't get more than 3-4Mbps (usually hovers around 1.5Mbps after starting up). Sometimes the copy will kick off a bit higher like 8-12Mbps for a couple seconds but without fail, it always almost immediately then slides down to 1-2Mbps and hovers around there: Any idea how I can find and fix the Bottleneck? Running MX95 at hub and MX68 at spoke. Both have 100/100 internet. MX are all up to date (MX 18.208). Also running MS-125 and MS-425 switches connected via SPF+ 10G and 40GB cables. I my speeds on the LAN are fine; it's just the SD-Wan spoke that is suffering. I've also played around with MTU as suggested in some other posts but that has had no effect, either. At a total loss here... Any ideas would be greatly appreciated.

from_afar · ‎Apr 25 2024

I tried disabling AMP and Umbrella on the spoke MX68, but am still getting the same speeds. Any idea where else I could look for a culprit? Speed test shows 120Mbps down and 26Mbps up. Copying a file in either direction is limited to 3Mbps, sometimes will jump to 5Mbps for a split second when copying to the server, but never more than that. Average is 3Mbps.

from_afar · ‎Apr 19 2024

Sorry for the delayed response. Yes, we are using Umbrella but I tried disabling all of the protection for this test and it didn't make any difference. No traffic shaping whatsoever.

from_afar · ‎Apr 19 2024

Thanks for the reply. I have not made any changes to MTU so they are all default (automatic). Testing on the server itself, it seems everything is set to 1500 ping www.meraki.com -l 1472 -f Pinging www.meraki.com [18.161.21.100] with 1472 bytes of data: Reply from 18.161.21.100: bytes=1472 time=5ms TTL=247 On the Hub/Lan, I get file copy speeds upwards of 1.5GBits/sec. All of the speeds are set to auto; VMware sees the 10Gb speeds, though:

from_afar · ‎Apr 18 2024

Thanks for the reply. Yes, we are using Umbrellas threat protection services. we have 1gig connections at both locations. MS-125-48, MS-425, MX-68 at spoke and MX-95 at hub. The hub is connected via spf+ 10gig between and 40gig to the host where the servers live.

from_afar · ‎Apr 16 2024

I'm getting terrible results in Windows file sharing on my Hub and Single Spoke setup. Speed test shows ~230Mbps down/200Mbps up, but when I go to copy a file from a Windows 22 server on the Hub to a Win 10 machine on the spoke, the file copy speed hangs at about 1-3MB/s, maxing out at 4. The ethernet interface show 1GB speed so I'm not sure why the performance is so bad. Also using Umbrella if that matters. Latency and Loss all seem reasonable so don't think it's that: Thanks for any ideas.

from_afar · ‎Apr 8 2024

Yes, things seem to be working fine at the main site--it's just the SD-Wan users that are experiencing issues.

from_afar · ‎Apr 5 2024

Ah, right, that makes sense, thanks. At any rate, doesn't seem like there is much interference or anything. Any other ideas of where I could look? Thanks.

from_afar · ‎Apr 5 2024

Thanks for the reply. I can't seem to get to a view like yours, but I do have a VPN Status menu item under the Organization and Security & SD-WAN menu items. They both seem to take me to the same place: If I then click to the left of the Description on the networks, it brings me to a page that shows the same info you are seeing. Here is the Hub: and the spoke: both from over the last 2 hours. I just don't seem to have a way to get to a page where they all show at once and I can flip between them like you do. I do have the option on the top-right of some pages to "View old version", but I tried that and it didn't show anything like your image--just a different VPN status dashboard. Again doesn't seem too bad...and the charts seem to show plenty of bandwidth so not sure why the performance for the people at the spoke location seems so bad.

from_afar · ‎Apr 5 2024

Thanks very much. I'm limited in what I can see/admin as I'm going through ATT for the service, but I can see the appliance uplink page. The Hub shows no loss, the spoke shows a couple of tiny (<1%) spikes over the last day. The Latency for the hub is steady around 3.5ms and spoke 8ms. Here is the spoke appliance uplink graph over the last day: are those tiny loss spikes enough you think to cause these kinds of issues?

from_afar · ‎Apr 5 2024

Not that I can see. Would that show in the event logs? I see "sent unexpected packets" every once in a while but nothing about packet loss in the event logs.

from_afar · ‎Apr 5 2024

We have a single Spoke and Hub SD-Wan set up with only the one spoke and the hub. The hub users connect to Windows machines on the hub LAN to work (open files to work on them in various programs, group policy, printers are all on these servers) and there seems to be connectivity issues sometimes. Some programs crash. Some print jobs crash or take a long time or duplicate. Some of the errors I've seen point to connectivity issues with the server on the hub. The only events I see in the Spoke's event logs are DHCP events and SNORT update, nothing about connection errors. Any ideas where I could look or what might be causing these issues? Thanks.

from_afar · ‎Mar 8 2024

We are licensed for Umbrella SIG Advantage and are in the process of setting things up. I have fired up the 2 local appliances and have DHCP setting those as DNS for everyone. However, instead of getting block pages, there are still a lot of blocks that result in the page just timing out. This made me wonder: if using Umbrella, should I get rid of all of the Category blocks and threat protection settings on the MX devices? We have yet to set up the Network tunnel so for now are just testing DNS, but was curious what other people have done.

from_afar · ‎Feb 21 2024

I contacted the NOC and they couldn't help me. It looks like they (AT&T) enabled Umbrella and I haven't had the chance to set up the local appliance yet so all DNS was failing. I disabled Umbrella and things are working again. Thanks for the quick reply.

from_afar · ‎Feb 21 2024

I started getting messages from users this morning that connecting to AnyConnect, they all of a sudden cannot access resources. I tried connecting myself, and when the VPN is active, I get a Non-existent domain error with nslookup. Connected locally, everything works fine. All dns servers are up and running. The adapter says "unidentified connection" as well. I can ping the dns server when connected, though. Any idea what could be causing this issue? I have not made any changes to any of the settings and things worked fine yesterday.

from_afar · ‎Feb 12 2024

Good call. That seems to be what happened. Strangely, in the switch config interface, it did have a correct subnet IP assigned as DHCP, but when clicking the edit button, I can see the static configuration. I wonder if this static config kept the device from reaching the internet and getting the correct new config from me? But if that were the case, it would seem that the device wouldn't be manageable at all. I would have thought that a factory reset would have wiped the previous config and prevented it from retrieving the old config completely. Is there another way to reset the device that completely wipes it? Thank you!

from_afar · ‎Feb 11 2024

I replaced a couple of MS120 with MS125 over the weekend and I'm seeing an odd error. I bought them refurbished and it seemed the old owner didn't remove the config. When I plugged them in, I couldn't get anything to work. So I pushed the reset buttons for ~5 seconds and then things started working,. However, I'm now seeing strange things in the event log. I'm getting a ton of "extra: no_offers_received, vap: 0, vlan: 100" errors. I do not have a VLAN 100: and I am not using a 10.110.x.x subnet anywhere, but it seems the devices both have 10.110.x.x addresses: I'm running a DHCP server on the network, and there are plenty of addresses available. Allow DHCP servers is set and there is only the one on the network. It seems like what happened is that the MX95 saw the original config on the MS125's and after resetting them, it didn't recognize that things have changed. Is there any way to force the system to re-check the setup and get the correct IP addresses/VLAN's? Thanks.

from_afar · ‎Feb 9 2024

It seems that it's not possible to delete clients from the interface. As such, is it then OK to ignore IP conflict event logs for devices that have had their IP address changed and/or are no longer part of the network? I have a NAS device that has 4 NICs. I had the device connected via a couple of the NICs as I was setting everything up and I eventually created a BOND on the NAS with several NICs combined. Since then, I have been seeing ip conflict entries in the event log because Meraki sees that the new bond IP address is the same as one of the previous individual NIC addresses. Is it OK to ignore these events? Or is there a way to remote old clients from the system that I have missed?

from_afar · ‎Feb 7 2024

Thanks for the reply. As mentioned, this is a super-simple setup--just the one hub and one spoke and configured as "single lan", so not using any VLANs outside of that. Sounds like I'm just seeing the content filtering happening on the device being logged and the traffic is flowing as expected.

from_afar · ‎Feb 7 2024

Thanks for the reply. The setup is very simple: just the one hub and one spoke. I indeed do have the hub configured with the IPv4 Default route checkbox checked: The Main subnet at the spoke location does have VPN mode enabled as I was connecting there to do some testing. Should this be disabled? Nobody needs to VPN in to the spoke location so it's not needed except for testing. Edit: actually, to test, I just VPN'd into that location and when the VPN is active, checking my IP address shows the correct HUB IP. Would the AnyConnect VPN be different than the SD-wan?

About from_afar

from_afar

Community Record

Badges