Interesting.  Do you see any CRC errors in the live packet counters? Is the router also negotiating correctly with that port or do you see a different negotiated speed on the router? Remember if negotiation fails you could get stuck in a 100 Mbps half duplex setting causing plenty of collisions. ... View more

How did you limit your 1 hour per day?  Usually you only have a reauthentication timeout by setting the splash page frequency. I guess you will have to also check your radius configuration. ... View more

10 Gig SFP+ ports are backwards compatible with 1 Gig SFP's.  25 Gig SFP28 ports are backwards compatible with 10 Gig SFP+ and 1 Gig SFP modules. 100 Gig QSFP28 ports are backwards compatible with 40 Gig QSFP+ ports. 🙂 ... View more

We are in a strange area now where the C9300 is the main platform supporting adaptive policy.  You could also use the MS130 in the future but those models are not stackable and a no go for me in most of my customer cases.  So I'm waiting for full support on the C9200 range or if Meraki would release an MS230 range.  Because the C9300 range is a bit expensive for most of my customers 😉 ... View more

Do you need stacking? If no, you can stick to the MS1xx range, if yes you at least need the MS210/225 range. Do you need dynamic routing or redundant power supplies?  You need at least MS250 range. Do you have high ASIC needs, lot's of layer 2 clients and high performance, you need MS3xx range. ... View more

This error has occurred in another case a few years back. It is definitely a dashboard error and support will be able to fix that for you. ... View more

Well you know it depends on alot of factors. Your endpoints, your environment and the type of applications you use will all have an effect on the effective usable range of the AP. When I put an MR28 on an empty floorplan (open air) on a height of 2.4 meters height (ceiling mount) where I use a laptop as reference (-3 dB) I get a border of -67 dBm at +/- 40 meters from the AP in multiple directions and 30 in 1 direction.  Do mind that this is the radius not the diameter.     ... View more

No problem. The logs can indeed only give you insight into the timings of the establishments and tear downs of each tunnel.  Also when obvious errors are present you will get logging of it. The only thing you can do is do extensive packet captures on the WAN side of your MX while filtering on port 500 or port 4500.  You can see what devices does what and when.   However after the key negotiation every exchange is encrypted you are left guessing by seeing what device initiated something or killed something.   I hope they would enhance the logging even for established tunnels so you can actually see what the other side sent. ... View more

True, but I would rather compare the MS425 to a C9500 since the stacking can be remote.  If everything is in the same closet and you can tolerate some outage during upgrades then sure I would fully agree. I also heard Meraki would be keeping their own product models too.   My own point is more about that there isn't for example a 'MS435' model that expands on the features of the MS425 so it would be strange if Meraki would EOS the MS425.   Only when Meraki would fully support C9500, C9300 and C9200 natively I could see a scenario where current models could be EOS'd. ... View more

It looks like your IKE SA's are quickly terminated from your second connection on. There could be a strange state of one of the sides (firewalls) where they don't want to keep connections open anymore.  It also takes alot of time to reestablish a new IKE SA after closing the previous one.  It normally should take just a second, not over a minute. It might be an idea to reboot the devices on both ends in a window. Also please check the lifetime values on both ends (you could try a half day or a full day for the IKE SA and make sure all your networks match exactly at both ends. ... View more

I don't see that coming any time soon. There is no replacement product for those downlink speeds. ... View more

I'm not from the UK and I had to nag my employer already to go to CLEUR so that won't work for me. I do look forward if you learned any new nuggets that you wish to share 😉 ... View more

Any MX using NBAR can recognize MS Teams traffic. What I personally always do is the following: I always match all voice applications and give these a DSCP EF marking (so I have to assume the high setting will be ignored and the MX will put them in the realtime queue).  Notice the MS Teams Audio tag in the config. Then the second rule matches the rest of voice and video which will be the video and call signaling protocols and those then get the AF41 and high queue.  Since matching is always done top down this configuration should work.   It is important that the voice part hits the realtime queue of your MX so it goes outbound first.  Once your packet hits the internet it is fair game for any kind of treatment.  So you only have control of outbound packets on your own MX towards the ISP. ... View more

Suspensions are only on the Catalyst side and have to do with either configuration mismatch or operational mismatch. So if both ports are configured with the same layer 1 and 2 things (being speed/duplex for layer 1 and trunk config at layer 2) then you will also have to look at the operational state.  In some cases in autonegotiation on copper if you have a 1 gig and a 10 gig in the same channel then you will have a suspended member.   I'm not a 100% sure if the suspended state can also come from a member mismatch (if the switch at the other end uses a different local MAC on each member).   It is best to enable terminal monitor on the catalyst if you have SSH'd into it and disable the port and re enable it.  You may have the issue listed in the syslogs that appear when it suspends again.   There can however be some weird bugs with port channels on Catalysts where you could temporarily remove the members from the channel and re add them to fix. ... View more

WB everyone! ... View more

Well I don't want to be responsible for a "custom" solution since I would be made responsible if it goes south. So in the case Meraki made an RMA but immediately for the MX appliances themselves so I'm curious how that will go and if they will arrive tomorrow so I can have them ready for friday. ... View more

So I went to another customer today that also has new MX67's but these still have the normal power adapters from Delta.  And these keep the cable sitting correctly. ... View more

So the MX is actually forwarding the traffic to said IP and port like you configured.  Can you verify in the packet capture or more detailed new packet capture that the destination MAC address is in fact the MAC address of the machine running SSH? If yes you could verify on the switch where the host is at that the packet is delivered to the end host and the problem has to do with perhaps the client firewall or client routing back out. ... View more

The moment you have IPv6 support on you get the VLAN objects. The reasoning is that VLAN objects match both IPv4 and all the different IPv6 addresses a certain host has in a certain VLAN. I really like this dynamic object and would love it if Meraki would just enable this at all times regardless of the IPv6 support state. ... View more

If you have 2 MX'es in a warm spare setup please check if you are running virtual IP or not. In this setup you should do that and you must use the virtual IP as destination on your ISP router.   When testing you could run a temporary packet capture on the Internet side of your active MX to see if your SSH traffic is even reaching the MX. ... View more

I have opened a case this morning: 11259698 and referenced this community post in that. So yes it is at the C14 side. The problem is not the C14 connection on the cable since I tested those cables on the switch and there they provided enough friction to firmly stay in the switch.  It is the power adapter that is in error here.  I have asked if they can do an RMA of the adapter only.  I'm not sure if that is going to work though. I have to install the MX'es on site this Friday. ... View more

I guess we need some end point manufacturer info about what the typical maximum Tx powers will be of laptops, smartphones etc...   If you know the FCC ID of a certain device you could lookup the documentation.  I have been looking at tests for apple products and I do find stuff like antenna gains and transmitpowers.  But you really need to look hard. ... View more