@MRCUR That could very well be the case. I've only been working with Meraki gear for about a year so I can't say how long it's been there. I'm glad it is there because I would have been very frustrated if I went to do this and needed a whole new piece of hardware to get it done. ... View more

@RyanB Not at all!  Join the conversation and bring forward ideas!  If my assessment of that article is incorrect please by all means call me out on it 🙂     ... View more

That's incorrect @MRCUR   https://documentation.meraki.com/MX-Z/NAT_and_Port_Forwarding/Port_Forwarding_and_NAT_Rules_on_the_MX#1:1_NAT   " It can also translate public IP addresses in different subnets than WAN interface address if the ISP routes traffic for the subnet towards the MX interface. "     ... View more

@RyanB I dispute it's greatness. See my comments above 🙂 ... View more

...And, Meraki has officially changed their documentation on this. The heartbeat cable is no longer a recommended configuration.   https://documentation.meraki.com/MX-Z/Deployment_Guides/NAT_Mode_Warm_Spare_(NAT_HA)#Recommended_Topologies   Yay! ... View more

You don't need to create a new Org, just a new Network.  ... View more

Hi @Pugmiester,   I did not mean ARP entries, I mean MAC address table entries. They are not the same. ... View more

@GreenMan Yup, I'm with you on the simple path part. I'm just saying that the dedicated VLAN over a dedicated link for "heartbeats" is flawed thinking as VRRP doesn't work that way, and you can't deterministically predict where the DB sync traffic is going.    What is needed to complete this setup is a way to flag the heartbeat VLAN as the heartbeat VLAN. Right now there is no such control on the MX. ... View more

So you have MXes in Warm Spare (running VRRP between them) and you have two Cisco routers running HSRP between them, with both pairs doing so on both LAN VLANs?   Which pair are supposed to be the default gateways for your clients? Are you doing some creative redirect routing here? Perhaps a simple diagram may help.   That aside, I think I would start with checking MAC address tables when the problem is occurring and ensure the switches all have the correct entry for the Cisco MACs (and HSRP virtual MAC). If that's correct I might start taking some packet captures on the switch interfaces facing the Cisco routers to see what's on the wire.  ... View more

@GreenMan   There are issues with Willette's topology, and I would not suggest using it. The first is that VRRP heartbeats are sent on all VLANs, so creating a dedicated "heartbeat VLAN" is not actually possible. Second, what you can do is use this dedicated VLAN for DHCP database synchronization... But because there are no actual knobs in the dashboard to configure this the MX will use the link that comes up first. That's great if your dedicated VLAN comes up first, but if not then it could be any of the other links to the switches making this non-deterministic.    IMHO this architecture is incorrect and falsely gives people the impression they are controlling something they cannot actually control.    @PhilipDAth's suggestion is the best topology to use here.  ... View more

@PhilipDAth While it's crazy you have a 10 month streak going on, you certainly put the work in and earn it. My comment was purely meant in fun 🙂 If anyone does dethrone you I sincerely hope it's because they also put in the work and earn it.   You and @CarolineS were totally responsible for a huge pile of my kudos, I know I got a lot for some gratuitous Cisco Live posts as opposed to putting up actual content, or solving problems. I did also notice that you kudo'd me a lot. That was very admirable as I thought it shows you're not concerned about someone with good posts taking the spotlight away from you. You seem to be quite happy to give credit where credit is due. That's good sportsmanship, and my hat goes off to you. ... View more

Woohoo!   Thanks @CarolineS! It was a fun month actually contributing instead of just lurking, like I have been since last year. There's some smart people hanging out here and it's humbling to be ranked among them, even if it's just one month.    Thanks @Adam! That's very nice of you to say that. You're clearly no slouch yourself, and I've enjoyed reading your insight into a lot of the problems raised here. Now... What do you say you and I team up and dethrone @PhilipDAth ? 😉     ... View more

@lpopejoy No, I'm saying nearly all "PCI Complaint" devices are only PCI compliant when configured to meet PCI requirements. If you introduce a configuration that is not PCI compliant then the device is no longer PCI compliant.    As with nearly all things, the devil is in the details.    @PhilipDAth My understanding was this fails due to client VPN using Aggressive Mode. If there was an option for Main Mode it would pass.  ... View more

What @Adam said. Inbound only 😞   But... If you were to use the second WAN port and assign a second external address to that, then you could use Internet flow preferences to steer some traffic out the second IP (and in) giving you two public IP's.    It's not how it's meant to work, and not clean by any stretch, but if you absolutely needed to second IP for say, have one specific server use a specific IP outbound, it could work.    Disclaimer, I haven't tried this directly, but I don't see why it wouldn't work. ... View more

There is. Disable client VPN 😛   Seriously though, your question is more philosophical than practical. For people who don't work in a PCI environment they couldn't care less. For those who do evaluating this sort of thing should be done prior to implementing the device. It doesn't seem wise to put a non-compliant device into a PCI environment, and then blaming the device. I don't mean to take a shot at anyone in this position, but it's the truth.   There is IKEv2 support coming. And so is AnyConnect support. Those will solve this. ... View more

The MX datasheet says the MX400/600 are "internal" whereas the MX250/450 are "modular" on page 7.   https://meraki.cisco.com/lib/pdf/meraki_datasheet_mx.pdf   😞     ... View more

The Org Overview page is the closest you're going to get to that. There's no way to custom build dashbaords in the Meraki dashboard. That does show a lot of what you're asking, but not all. ... View more

You can't get CPU by itself, but you can get a composite "Load" metric that's made up of CPU, traffic, and I believe memory (don't take that a fact...).   https://documentation.meraki.com/MX-Z/Monitoring_and_Reporting/Load_Monitoring     ... View more

Yeah totally. 60 seconds is very reasonable. Just have to write something to grab it ans display it.  That might be a great little exercise for me right now since I'm trying to learn some Python. If I do do it I'll post back here. No promises though 😛 ... View more

I thought I could maybe be clever and and trick the dashboard into showing me just one hour by manipulating the URL string to just have a date range of one hour.   t0=1529971200&t1=1529971260   That's at the end of the URL, and it's just Unix time for start and end. But, Meraki saw me coming on this one and all I'm getting is spinning wheels 😞   Oh well. ... View more

@Adam thanks dude. I got lucky there. I've been trying to learn myself some Python this week and it was just Monday I was playing around with the API a bit. Last week I never would known that 🙂 ... View more

Woohoo! ... View more