Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About OVERKILL
About OVERKILL
OVERKILL
Building a reputation
Member since Jul 17, 2020
3 weeks ago
Community Record
134
Posts
71
Kudos
4
Solutions
Badges
Mar 20 2022
5:51 PM
Just use AnyConnect. I ran into a similar issue recently (cell wouldn't work, but it worked fine with a laptop) so I just had him download the AnyConnect client and it worked perfectly right out of the gate.
... View more
Mar 20 2022
3:25 PM
2 Kudos
I have a ticket open with Meraki on this issue, but the run-down: I have a site that I switched to AnyConnect near the end of last year, just using the default config, as they only have a couple of users, so default port of 443. Well, a few weeks ago, I get a call from them that their "internet is going up and down". Check the dashboard, see no immediate evidence of this happening (all green) and told her I'd upgrade them to 16.16, which I had scheduled, that night, and we'll see if that fixed it. Well, we had one day of nothing happening and then it started again.Checked the logs more thoroughly this time and saw that all ports that had a link on them had flapped. Odd. I searched specifically for that and saw that this appeared to be happening at least once a day.I opened a ticket and they apparently saw some issues in the logs and told me they were sending me a new unit. Excellent I thought. So, installed the new unit and figured I'd check the logs to ensure that this error message was gone. It wasn't. I was seeing the exact same thing with the replacement unit: Support didn't seem concerned because the customer hadn't complained yet, but I logged into the 2960 stack that's one of the units behind the MX and it was showing its uplink being connected/disconnected when I see the flap in the MX logs, so clearly, this is still actively taking place (GI1/0/1): Then I noticed that the AnyConnect service seemed to be restarting at the same time: Also, because of the use of the default, port, the AnyConnect service was getting hammered by foreign IP's and this appeared to be triggered it to restart: So, while I wait on support to get back to me, I just changed the port AnyConnect was on to stop the hammering, and, so far, it has been 24hrs and no interface flap, but the real test will be tomorrow morning when all the users are back, as this may just be an unrelated correlation. However, IF this observation does indeed show that the hits on the service are triggering the interface flap, there is clearly an issue with the service that will have to be dealt with.
... View more
Labels:
- Labels:
-
Other
Mar 11 2022
9:47 AM
May not be related to your situation, but I had a site that was on 16.14 that was fine until last week and then they started experiencing outages. Upgraded them to 16.16 the night before last to see if it would help, had another outage again today. Outage apparently lasts 5 or 10 minutes. Checked the logs and it flapped ALL the active interfaces: It's connected to a stack of 2960S switches and its logs show the link, fluttering at 9:27 then going down at 9:35 then coming back up at the time we see there in the Meraki log. The flutters don't show in the Meraki log, only the result of what appears to be all of the active interfaces resetting including the WAN links. I opened a support case this AM, we'll see what's going on.
... View more
Mar 7 2022
2:02 PM
This moves 16.xx into GA, so for those of us using AnyConnect through the Beta and RC, I know we have to buy AnyConnect licenses, which I have my wholesaler working on now, but how much of a grace period is there, assuming there will be license enforcement now?
... View more
Feb 16 2022
7:38 PM
Yes, I can confirm the same. For the last few weeks, just ensuring a client workstation has all the latest updates resolves the problem.
... View more
Feb 14 2022
11:19 AM
6 Kudos
You can do a lot of the pre-deployment configuration in the cloud but the device will need a way to download that configuration when it is hooked up. I've done this with a few devices that were being sent to remote sites. One was an MX64 being sent to a satellite clinic with a static cable connection. I logged into the webUI on the device and configured the WAN information so that it would work once connected. Then I built the remainder of the config via the portal which the device pulled down once it was connected on-site. Does that answer your question?
... View more
Jan 17 2022
10:05 AM
Yes, the 14.xx releases aren't impacted because the vendor_ID flag isn't set in the firmware. That was added with the 15.xx series and that seems to be what is causing the issue on the Microsoft side.
... View more
Jan 15 2022
10:57 AM
AnyConnect IS available on the Meraki platform, currently without a fee (because you need to be running 16.xx) but there will be a charge once the 16-series because stable.
... View more
Oct 14 2021
8:15 PM
Pretty minor upgrade from 16.12 from the looks of things, thanks for the share.
... View more
Oct 13 2021
6:48 AM
2 Kudos
Yes, the issue was fixed in 16.11. Of note, 16.12 has some significant improvements, including VPN throughput that makes it a worthwhile upgrade.
... View more
Jul 26 2021
2:37 PM
1 Kudo
Nope, it's still broken, please see the update in my thread.
... View more
Jul 26 2021
7:12 AM
Yeah, that's my situation, all my MX's that run AnyConnect are on 16.6 or 16.7 now from the roll-back, 16.8 didn't fix anything significant from what I can see over those two releases so I'll probably just leave them there until we get a release that's an improvement.
... View more
Jul 25 2021
10:22 PM
Update: With 16.10 out now, I checked the Release Notes to see what was still broken, it appears this is, along with the VPN performance hit that appeared in 16.4, so I guess I"m skipping this one.
... View more
Jul 25 2021
10:19 PM
1 Kudo
It is now, but I'm not sure it was when 16.9 was released.
... View more
Jul 18 2021
8:54 PM
1 Kudo
So, it seems the "solution" to this is to roll-back the firmware, then rename the device, wait until that takes (you can check by hitting the hostname with a browser until the new one works and it shows a valid SSL certificate that isn't self-signed) then changing it back to the previous hostname, which will then get another valid certificate. At this point, 16.9 breaks AnyConnect.
... View more
Jul 15 2021
6:38 PM
I performed what was indicated by @KarstenI on the MX I rolled back to 16.7 and it worked in terms of creating a valid certificate again. I forwarded this thread to the guy I was speaking with on the ticket, but I haven't heard anything back yet, but at least the error is gone.
... View more
Jul 15 2021
9:20 AM
OK thanks. I'll try that after hours on them if we don't get this resolved today.
... View more
Jul 15 2021
9:13 AM
Have you tried this with 16.9? I ask because, as per the separate thread I made on this, I can't even get AnyConnect to come up or resolve on another MX I have that I upgraded. I feel this may be a bigger issue on the certificate issuing and hostname integration side of things. I've opened a ticket about it.
... View more
Jul 15 2021
6:24 AM
Adding to this, I enabled AnyConnect on a unit that normally doesn't have it running (my personal MX) that I also upgraded to 16.9 and the service doesn't seem to be coming up (it's been about 20 minutes). Checking the event log, I see no mention of AnyConnect starting, rather, I'm seeing these suppressed log message notifications:
... View more
Jul 15 2021
6:05 AM
1 Kudo
This was mentioned in the official release thread for 16.9 but I think it warrants its own thread. I upgraded two MX84's running 16.7 to 16.9 last night, both are now throwing certificate errors to the clients. This is what we were getting before the upgrade: MX running 16.7 software And this is what both units are throwing this AM: MX running 16.9 software I rolled-back the firmware upgrade on one of them about 10 minutes ago and it is still throwing the self-signed certificate error unfortunately, which means that once you perform the upgrade, you cannot un-break it.
... View more
Jul 15 2021
5:50 AM
Just note that rolling back to 16.7 on one of the devices didn't fix the issue, it has a self-signed cert again.
... View more
Jul 15 2021
5:26 AM
Yep, I upgraded two sites last night and now I'm getting this as well. @Bsalami may be able to get this resolved quickly I'm hoping. My sites were running 16.6 and 16.7 respectively. It appears it shifted from an an external CA-issued cert to a self-signed one. This is what we get now: Unit running 16.9 This is from a unit running 16.7: Unit running 16.7
... View more
Apr 7 2021
5:58 AM
This. Under Security and SD-WAN -> Site-to-Site VPN -> VPN Settings -> Local Networks Ensure that the networks you want accessible over the VPN are selected.
... View more
Apr 3 2021
2:07 PM
There was indeed just a single uplink to the MX84 at the time of the issue. I connected the 2960 to the MX84 on a separate port just to test, it made no difference. It would pass VLAN2 traffic on the switches that it wouldn't pass VLAN1 traffic on, which was the most interesting bit. The MX84 has been running without issue for about a year. I'm pulling the Cisco SB switch as they are changing software vendors. I'm putting in a stack of 2960's for the main LAN, VLAN2 will most likely stay on an HP but we'll see what port utilization looks like after the 3x 2960's are installed. All the HPE switches are using 802.1D, not RSTP (802.1W). I unfortunately don't have access to the configuration on the Cisco SB switch, since it was vendor provided. That's another reason I'm inclined to punt it once they are out of the picture.
... View more
- « Previous
- Next »
My Accepted Solutions
| Subject | Views | Posted |
|---|---|---|
| 1628 | Apr 14 2022 12:28 PM | |
| 8332 | Apr 3 2022 10:49 AM | |
| 4420 | Mar 21 2022 3:24 PM | |
| 3332 | Jul 18 2021 8:54 PM |
My Top Kudoed Posts
| Subject | Kudos | Views |
|---|---|---|
| 6 | 1388 | |
| 4 | 6067 | |
| 3 | 1088 | |
| 3 | 5289 | |
| 3 | 8044 |
© 2024 Cisco Systems, Inc.
