Meraki

RWelch

This article provides technical data on Fiber Transceivers and stacking accessories compatible with Meraki devices. Small-Form Factor Pluggable (SFP) and Stacking Accessories

RWelch

SD-WAN Internet Policies (SD-Internet)

RWelch

When you login to the Meraki dashboard, is the account you are using at least a network admin or organization admin? Organization -> Configure -> Administrators Managing Dashboard Administrators and Permissions Managing Dashboard Administrators and Permissions (Modernized View)

RWelch

@Mloraditch provided a glimpse into the future a while back for your consideration (see link below). While the MS225s are still active the future roadmap shows MS150s as its replacement. The C9300 series would be considered a step-up in capabilities/features/functionality. Really Cool Meraki Product Line Trees

RWelch

Hi @NishP there are two VPN status. Option 1: Organization > VPN Status which isn't as detailed as option 2. Option 2: Security & SD-WAN > Monitor > VPN Status which allows you to see IPSec peers which I am assuming you are using with Fortinet in the equation. Give option 2 a try to see if it shows an IPSec Peer tab (as seen in @alemabrahao picture shared). VPN Status Page

RWelch

The advanced security license and Secure SD-WAN+ will allow IDS/IPS (yes) whereas it's not an option with the enterprise license.

RWelch

I would check each device's group policy and how DNS is configured for each. @ww provided a good way to see what GP is applied to each device (just below).

RWelch

Are you using enterprise or advanced licensing? Meraki MX/Z Security and SD-WAN Licensing

RWelch

And as mentioned already by @alemabrahao checking your gateway, subnet mask and DNS are configured correctly. I would also encourage you to "double check" how clients are being assigned static / dynamic IPs - meaning have you properly allocated the reserve IP reservations and fixed IP reservations? These can also come into the equation if not applied correctly.

RWelch

If you previously assigned a manual custom GP and applied it to select clients, these clients might still be looking for the deleted manual custom GP. Have you tried to whitelist (allow list) these clients? Or you can select them and re-assign the normal profile so they aren't looking for a previously assigned manual custom GP.

RWelch

Do the clients connected to the MX ports have a "normal" group policy or are they using a group policy that you have created?

RWelch

Hello @overblower - on Friday you had a post asking how to Block Internet Access but Allow Auto VPN Communication on MX75. If you happened to implemented the changes suggested, that might be the reason you aren't able to access the internet.

RWelch

If you were to use the search bar at the top of the Meraki Community page and search MPLS you will find quite a few posts regarding MPLS in the equation (if interested).

RWelch

Integrating an MPLS Connection on the MX LAN Configuring Site-to-site VPN over MPLS

RWelch

If you were to click on the client with the long string you should be able to change the name by clicking on the pencil and putting whatever name you wish for this device. Or you can set a DHCP reservation with the client device's MAC address and put a friendly name. Either way you can adjust the UUID client ID to a more friendly name. The DHCP reservation would likely offer the best approach if this particular device connects to the network on a routine basis while it might seem like a bit more manual work upfront it will keep your device names cleaner (long term).

RWelch

Creating and Deleting Dashboard Networks If it were my project, I'd create a new network in your organization and then select "change organization" from wherever the external network resides and place it within your newly created network within your organization (as well as any other Meraki devices - MS, MR, MG, MV and MT as well). I would do this in a maintenance window so as to not interrupt business operations and you'd likely need to configure it after placed into the newly created network - but in the end, your network will have less headaches being able to leverage S2S AutoVPN (long term wise) vs NMVPN. Others might chime in to add their thoughts.

RWelch

IMO - life would be a lot easier if you are able to migrate the remote network over to your organization and leverage the AutoVPN functionality (unless there is some compelling reason to not have it as part of your organization).

RWelch

Port 10 (switch) to Port 12 MX is in access mode VLAN 1000 (management). Port 2 (switch) to MX WAN 1 is in access mode vlan 900 (ISP link up/down). The management and ISP upstream/downstream are separated via access ports (is the difference).

RWelch

Thanks for the correction @Ryan_Miles

RWelch

Cloning should work ok - difference being # of ports, PoE budget (total) differences, SFP+, MS130 has a few more added features and mGig whereas the MS120 doesn't. Because the MS130 has additional ports than the MS120 the MS130 additional ports are likely to be set with default settings since the MS120 doesn't have these additional ports. Would be best to verify (manually review) all ports prior to the clone and after.

RWelch

Wouldn't your entries need to be adjusted? D1: Security Appliance: 143.161.65.1/24 to 143.161.65.0/24 (subnet) or 143.161.65.1/32 specific device IP D2 Security Appliance: 143.161.64.1/24 to 143.161.64.0/24 (subnet) or 143.161.64.1/32 specific device IP

RWelch

Seems odd (really really high) - curious what MR firmware are you running in your network? And do you have RRM enabled (perhaps the AI-RRM factor is contributing in this equation - somehow)? Asking because when I look at Air Marshall using my APs (MR 31.1.8) I too see elevated #s. The two at the bottom are both my APs in blue. And I do have AI-RRM enabled.

RWelch

As an alternate option (if interested), you can go to Security & SD-WAN > Monitor > Appliance Status and select the "tools" tab at the top of the page to test packet loss and latency for LAN devices. Select the source IP Address (whatever VLAN you are wanting to test from) Then provide the IP address of the device you want to look at the stats for latency/packet loss. Obviously this would be a short term test (not like the WAN Uplink statistics that runs in the background all of the time) but would give you indication of how a specific IP address is performing.

RWelch

Configuring Site-to-site VPN between MX Appliances in Different Organizations

RWelch

Are both MX in the same organization (S2S VPN)? Or are you trying to use NMVPN? Site-to-Site VPN Settings Meraki Auto VPN - Configuration and Troubleshooting

About RWelch

RWelch

Community Record

Badges