Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
About Twitch
Twitch
A model citizen
Member since Jan 6, 2019
Oct 14 2024
Community Record
160
Posts
78
Kudos
0
Solutions
Badges
Oct 7 2021
12:15 PM
2 Kudos
@cmr- we are running basic routing at this point. No crypto or access rules. When the circuits first went live we tested with laptops connected directly to the VPLS hand-off at several sites. Latency numbers were the same as what we see with the 2901s running, 25 - 40 msec. I did not know that tidbit about the limitations on the 2901s.
... View more
Oct 7 2021
10:00 AM
@cmr- We have distances ranging from roughly 6 miles to 430 miles to 750 miles. Latency is generally in the same range regardless of the distance. We are not running SD-WAN over the VPLS. We had SD-WAN running over our broadband internet connections to each site, but my boss wanted to get away from the site-to-site VPNs, so he decided to switch over to VPLS circuits between each site instead. We are using 2901s in order to route traffic via OSPF between sites. My boss's original plan was to use VLAN tagging over the VPLS, but he did not want to pay for the QinQ service, so we decided to route traffic via OSPF instead. Your latency is far superior, to say the least. Which company provides your circuits?
... View more
Oct 7 2021
8:17 AM
Hello to the Crew - for those of you sending traffic over VPLS circuits, what kind of latency numbers do you see? We currently have six of our locations running over a Cogent VPLS with a variety of LECs providing the last mile, including Verizon and Segra. The circuits have 28 - 40 ms of latency continuously, which seems very high to me. I see that at each site and in all directions between sites, regardless of the physical distance involved. When I called and spoke to a tech support guy at Cogent, I was told he saw the same thing on his side and, basically, "that's just the way it is." When I tried to question why it was so high, he gave some half answer and disconnected the call. We have Cisco 2901 routers running at the edge of our VPLS cloud. Circuits are 100 Mbps. If I run an extended ping from a VPLS router interface to another VPLS router interface, with nothing but the provider's network in-between, I still see 28 - 40 Mbps of latency. Is anyone seeing similar numbers on their circuits? Thanks. Twitch
... View more
Labels:
- Labels:
-
Traffic Analytics
Oct 5 2021
10:25 AM
That lists the MACs for an Apple device, most likely a cell phone, that was trying to get an IP from VLAN 4. I wonder if it's because some strange config on the phone itself? We have had some contractors working in our shop on a new piece of equipment.
... View more
Oct 5 2021
10:12 AM
Hey @BrandonS - sure did. The second screenshot above is what you find there. Not much to go on.
... View more
Oct 5 2021
5:45 AM
Morning everyone. Has anyone seen a situation where access points report a DHCP problem with a VLAN that doesn't exist? I have a site that is reporting a problem with some clients not being able to receive IP addresses from VLAN 4. The problem is, VLAN 4 does not exist in the environment. I have looked everywhere on devices in this network to make sure that VLAN 4 is not configured, and sure enough I can't find it anywhere. This does not impact performance in any way, since clients are receiving IPs from the correct VLAN. I'm just curious where this might be originating from more than anything. There also does not appear to be any way to clear the notification, either. Has anyone else seen this happening? Thanks. Twitch
... View more
Sep 24 2021
9:20 AM
1 Kudo
@Paul421- that's the exact issue we have been having as well. Our wireless clients get the same DHCP as the wired clients - same DNS as well - but the wireless mobile devices could not connect to wifi and reach the internet. Only mobile devices, though, which is even stranger. I could connect to wifi on my laptop and it worked okay. My cell phone, however, and other user's phones, and iPads - no joy. Connected without internet. Truly bizarre.
... View more
Sep 24 2021
8:00 AM
@bnorrell -Good morning. No separate layer 7 firewall rules for wireless clients. Everything firewall-related runs on the MX.
... View more
Sep 24 2021
7:59 AM
Hey Andy, good morning - we have everything firewall-related at the MX level. I could understand the geolocation issue impacting wireless clients if they were trying to reach Google services. It doesn't make sense that they would not be able to connect to the internet as a whole while a block on Hong Kong was in place, unless the issue is specific to how it is impacting Meraki devices, including access points in particular.
... View more
Sep 24 2021
7:32 AM
Is anyone else experiencing strange issues with their wifi this morning? We have been unable to get mobile devices connected to wifi this morning. Devices would receive a "Connected without internet" status. What's bizarre, is we temporarily removed the block on Hong Kong, and now mobile devices can use wireless over our network just fine. We can (as expected without Hong Kong blocked) ping Google as well, but what in the Sam Hill does a geoblock on Hong Kong have to do with our access points being able to pass traffic to the rest of non-Google internet? The wired network is working just fine, and our wireless devices receive DHCP from the same server that the wired clients get addresses from, so DNS should work just as well as it currently is for wired clients. How would a geoblock on Hong Kong prevent wireless clients from accessing the Internet? Is anyone experiencing this issue?????
... View more
Sep 24 2021
6:44 AM
7 Kudos
Agreed. A banner notification on the Dashboard would be awesome. I have beat my head against the wall this morning trying to figure-out what was going on. On another note, I would be very cautious about removing a block on Hong Kong just to reach Google. This could potentially be related to a cyber attack for all we know right now. Use DuckDuckGo for search instead.
... View more
Sep 24 2021
6:40 AM
Morning all. Strange question: is anyone else having trouble reaching any site run by Google this morning? Google.com, YouTube, Gmail, Google Docs, etc? I'm trying to determine if we have something going on with our network, or if this is part of a larger issue. Our access points won't connect cell phones (connected without internet), but computers connect just fine. We have made no changes to our networks all week, and of-course, on a Friday, things want to go haywire. Yesterday everything was working great. Our MX100 stats LED appears to a shade of green instead of the shade of almost white that it normally is. Other websites and the rest of the network (ie; file shares) are working fine. Happy Friday! I think...
... View more
Sep 23 2021
7:32 AM
Just an update - I have updated the IOS on the 2901 to 15.7(3)M6, enabled LLDP, enabled CDP, and on the connected Meraki switch port I have disabled STP. Yet, the unknown protocol drops continue to accumulate. It's very strange - at the sites where the 2901s are not connected to a Meraki switch, this issue doesn't exist, but at the sites with Meraki switches connected, the unknown protocol drops metric is always increasing. Somehow, some way, the Merakis are putting out traffic that the 2901 doesn't recognize. I have been traveling other sites too much to get a sniffer on the network to try and isolate which traffic is being dropped, if that's even possible. I don't believe this is impacting performance, per se, because users are not fussing about anything,but processing the drops would have some impact on CPU cycles, I would think. It's just more of an annoyance because I can't figure-out what's causing the drops. Twitch
... View more
Sep 17 2021
5:56 AM
Good morning, Crew. I have a question about traffic arriving to our MX via VPLS connection from a remote office. Once the traffic arrives at our data center MX, the MX is not passing the traffic to a non-Meraki peer connection to a remote data center in another state. Traceroute shows the traffic arriving at our MX transit VLAN IP, but then from there it dies. Remote ------VPLS------Data Center------Non-Meraki-------Remote Data Office MX Peer VPN Center We are trying to get the remote office access to a server in the remote data center. I tried a static route on the MX pointing to the IP remote network, but that didn't change anything. Am I missing something, or will the MX not automatically pass traffic destined for the remote network to the Non-Meraki Peer VPN as the next hop? Thanks! Twitch
... View more
Aug 17 2021
4:18 AM
Hey @ww - I issued the CDP Run command and cleared the counters, but the unknown protocol drops are still occurring. What a bizarre issue. Here are the counters before the clear command was issued: And after:
... View more
Aug 16 2021
2:35 PM
Hello to the Crew - I have a Cisco 2901 router that is experiencing a very high number of Unknown Protocol Drops on the interface that is connected to a Meraki MS-250 switch. The connection between the two devices is a trunk running at 1 Gbps, full duplex, native VLAN is 1 on both sides. The interface on the 2901 is a sub-interface of Gig 0/0, and acts as the default gateway for the network before passing traffic out over the VPLS circuit to another 2901 on the far end. In addition to the Unknown Protocol Drops, we are seeing a high amount of lag, and I have a hunch that the two are connected, but I have not been able to nail-down the cause yet. Has anyone else seen this issue specifically or a related issue when a Meraki switch is connected to a traditional IOS router? I would think the two would play together just fine, but maybe I am wrong. Thoughts? Thanks! Twitch
... View more
Jun 21 2021
1:56 PM
Thanks @PhilipDAth - That all makes sense. The one caveat is that we are running layer 3 switching on our switch stack, so I would assume I am going to add the static route to the other org there so it can be propagated via OSPF to our other sites that are currently on the VPLS? Our MX would then have a static route that points to the MX in concentrator mode for the other org so all traffic destined for the other org would be passed up from the switch stack and then routed over to the concentrator MX. We are currently running a mix of Auto-VPN and VPLS. The Auto-VPN will be going away (except for one frustrating site that can't connect to the VPLS), and we will be routing via OSPF between all sites. So, Auto-VPN will handle connectivity via some sites, and OSPF for others, but regardless of the method, I can see how this will work.
... View more
Jun 21 2021
6:45 AM
@PhilipDAth Interesting idea. Provided that we use our office as the transit site, I assume we can use our existing MX100? With regard to the 2nd MX in VPN concentrator mode, would that also be located at our office, with it's own separate internet connection? Or could it share the existing connection with our MX100? For the static routes, you're referring to adding static routes that point to the other orgs internal subnets, with their public IP as the next hop, correct? For example, 10.10.0.0/24 --> 2.2.2.1, with In VPN = Yes. Same on the other MX from the parent org with static routes pointing to our internal network?
... View more
Jun 14 2021
2:29 PM
@Greenberet- Thanks for sharing that! We will definitely check that out. Fortunately, my boss is a Code Monkey. Much appreciated.
... View more
Jun 14 2021
2:23 PM
3 Kudos
@cmr- If I am correctly reading this document: https://documentation.meraki.com/General_Administration/Organizations_and_Networks/Best_Practices_for_Merging_Networks_and_Organizations Merging the organizations involves completely dismantling all of our networks and rebuilding them from scratch in the new merged organization. From what I am gathering, nothing is transferable except the devices and the licenses - the configuration and all settings would be toast and have to be rebuilt from scratch. That does not sound like a fun weekend...
... View more
Jun 14 2021
2:03 PM
@cmr- That is the other option on the table. I have not started digging into that one yet. Hopefully Meraki has some documentation on how to do that. Without having to go into too much detail, how complicated is it to combine organizations?
... View more
Jun 14 2021
2:01 PM
@Bruce- Interesting idea. That almost makes my head hurt just reading it. 🤣 I can see how that would work, though.
... View more
Jun 14 2021
10:57 AM
1 Kudo
@Inderdeep @DarrenOC - Thanks for the replies. You both have confirmed my suspicions about how the VPN would have to be setup. @Inderdeep- That first bullet item causes me to wonder if the route advertisements will work with L3 switching enabled on our switch stack. We no longer have any subnets that are local to the MX, only static routes that point down to the stack. I'm thinking the static routes will still be advertised, since most of the routes have the "In VPN" box selected to advertise the static route to other VPN peers, which should work just fine for the non-Meraki peer VPN connection as well.
... View more
Jun 14 2021
9:55 AM
2 Kudos
Hey gang - what is the best practice for configuring a site-to-site VPN between two different organizations, for example, between our company organization and the organization of the parent company who just purchased us? Both sides have Meraki MXs at the edge. Based on reading that I have done, it looks like the site-to-site will need to be established as non-Meraki peers since two different organizations are involved. If that's the case, the docs also state (if I'm understanding it correctly), that route information will not be shared between the non-Meraki peers, which presents a problem of reachability for remote networks on both sides. Thoughts and/or clarifications would be greatly appreciated. Cheers! Twitch
... View more
My Top Kudoed Posts
| Subject | Kudos | Views |
|---|---|---|
| 7 | 42394 | |
| 5 | 1208 | |
| 3 | 20572 | |
| 3 | 9863 | |
| 3 | 24394 |
© 2024 Cisco Systems, Inc.
