Meraki

JamesT91 · ‎Apr 24 2025

Either NMVPN from every network to the 3rd party, or install a second MX into HQ, have the NMVPN from there and then static route to it from the main HQ MX.

JamesT91 · ‎Apr 17 2025

Now on the Meraki status page: Meraki Status - EMEA Cloud Monitored Catalyst Switches appearing offline in the Dashboard

JamesT91 · ‎Apr 17 2025

Yes - we are experiencing the same this morning. Interestingly out of 8 switches, 1 has recovered and is displaying online again but the other 7 are not. No feedback yet on our Meraki support ticket.

JamesT91 · ‎Apr 17 2025

Sounds like you need to be ringing Meraki support and having them assist in getting your network back online.

JamesT91 · ‎Apr 16 2025

Just under the regular Network-wide>Event Log page, you can event type include for: Intrusion detection rules update

JamesT91 · ‎Apr 16 2025

We are seeing this across multiple customers this morning - snort related perhaps? It would be great if you could get something up on the Meraki status page too.

JamesT91 · ‎Apr 8 2025

We have a greenfield deployment for a customer: Secure Connect, Azure vMX, multiple spoke networks spread across the globe. My question is around the integration of the vMX's into the design. They will be deployed as Hubs because we require eBGP to Azure Route Servers, but from what I am reading this then means that from a spoke deployment perspective they must have the Azure vMX networks as Hub priority 1 and 2, with the Secure Connect Hubs as 3 and 4. Surely this then means all spoke <> spoke traffic now traverses the vMX rather than Secure Connect, rendering any rules on the CDFW redundant and instead we would have to replicate them on the Site-to-Site outbound firewall rules page in Meraki? Is there a way I can avoid this, perhaps by having the Azure Hubs as picks 3 and 4 on the spoked and keeping Secure Connect as 1 and 2 (or would this simply not work??) I have raised a support ticket, but thought the community may also have some knowledge on the subject. 😊

JamesT91 · ‎Apr 8 2025

Sounds like you just need to make sure your device is kept online for >30 minutes after an upgrade for it to be "safe"? 😕

JamesT91 · ‎Apr 8 2025

Yup - absolute garbage, bring back the old way!

JamesT91 · ‎Mar 20 2025

You would need another MX to point the static route at, and have the NMVPN configured on that MX, as @rwiesmann was describing. If you use Secure Connect you can have a NMVPN tunnel terminate there and be shared by all spokes, but unless you're already in that ecosystem it would probably just be easier to get the 3rd party to create VPNs to every spoke network.

JamesT91 · ‎Mar 20 2025

VPN Full-Tunnel Exclusion (Application and IP/URL Based Local Internet Breakout) - Cisco Meraki Documentation You only need the SDWAN+ license to do major application VPN breakouts, you can still do custom expressions (IP/DNS) with the non-SDWAN+ license. The major applications list is fairly short anyway:

JamesT91 · ‎Mar 19 2025

There is nothing on the linked status page .. ? "All Systems Operational"

JamesT91 · ‎Mar 17 2025

We tend to use templates for LAN/WLAN but for SDWAN it just lacks the flexibility to be useful. If more overrides were available (load-balancing I am looking at you) and the full L7 NBAR list then we would be getting somewhere.

JamesT91 · ‎Mar 17 2025

Thanks @RWelch it is available on our shard now too, have just opted us in! We did try to ask support about early enablement / being on a shard that has it but that didn't go anywhere.

JamesT91 · ‎Mar 14 2025

Yes, this is now possible. Documentation: vMX NAT Mode Use Cases and FAQ - Cisco Meraki Documentation 2 useful threads: Configuring the Meraki vMX in Azure for Routed Mode with LAN/WAN Separation... - The Meraki Community Proof of Concept: Routed Mode vMX in Azure on MX 19.1 with Advanced Securit... - The Meraki Community

JamesT91 · ‎Mar 13 2025

What we have learnt over time is that you cannot trust the Meraki auto-updates to keep you updated and not have networks in "critical" status. You have to take ownership of the process (whether this be via API or manual).

JamesT91 · ‎Mar 10 2025

No - each device in the HA pair needs its own dedicated WAN IP. You can then optionally set up a VIP if you wanted too, from within the same subnet. As @KarstenI says - standard setup would be a /29 with 2 uplink ports from the ISP, this allows you to plug both your WANs into their equipment.

JamesT91 · ‎Mar 7 2025

Just to add some more weight to this, we have dozens out there in the wild and as far as I am aware none have experienced the reboot 'panic' issues that the MX75 has.

JamesT91 · ‎Mar 3 2025

This will partly come down to whether you are using Template networks or not, as when you chose what to upgrade (and presumably downgrade), all networks bound to a template are upgraded at the same time.

JamesT91 · ‎Feb 28 2025

Looking back through our ticket history we first starting running into this in November, so it has been a good few months already. ☹️

JamesT91 · ‎Feb 27 2025

Did you by chance make any amendments to the WAN port? We have run into this known issue quite a lot: Due to an issue under investigation, making certain configuration changes to WAN interfaces (such as disabling or enabling an interface) can cause the IDPS process to fail. This issue may also cause high device utilization. The issue can be worked around by rebooting the MX appliance or disabling and then re-enabling IDPS. (MX-34504)

JamesT91 · ‎Feb 24 2025

As well as this you need to test using actual end user devices, and not ping the MX itself as it will often ignore firewall rules. (Unclear if .3 is a host of the MX itself)

JamesT91 · ‎Feb 21 2025

During a maintenance window you remove the 0/0 route via the NMVPN peer, this should let you then create your networks, after which you can put the 0/0 route back in.

JamesT91 · ‎Feb 21 2025

I've encountered this before and it has been due to a similar/bigger CIDR prefix being routed via a NMVPN peer.

JamesT91 · ‎Feb 19 2025

We manage customers that range anywhere from 1 site to 100+ sites!

About JamesT91

JamesT91

Community Record

Badges