No, Geo-Blocking applies to both directions. No way to only apply it inbound to my knowledge.   https://documentation.meraki.com/MX/Firewall_and_Traffic_Shaping/MX_Firewall_Settings  ... View more

It could be a firewall rule or layer 2 isolation stoping you from connecting to your AIPhone device. You can check that in the meraki dashboard. Follow this link and see if you find something that helps 🙂 https://documentation.meraki.com/MR/Firewall_and_Traffic_Shaping/MR_Firewall_Rules    It could also be that your SSID is running in NAT mode. That would take a bit more work to solve. https://documentation.meraki.com/MR/Client_Addressing_and_Bridging/NAT_Mode_with_Meraki_DHCP  ... View more

Cool setup! So, to start with i would begin by configuring BGP unless its not already done. By the looks of it you will need the flexibility dynamic routing provides.   Is it better to be using One-arm Concentrator or Routed mode for this?  I started with Routed mode and then just switched to VPNC after reading about dc-dc failovers.  Now i'm believing I don't actually want DC-DC failover because I don't need any local networks to failover between DCs.  I just need traffic to reroute.  Would either method have limitations in my scenario? Note:  even if i were doing Routed mode, i still need the L3 switch in NY due to the HA pair of MX105s.  I would go for Concentrator mode unless you need the MX pairs in the DC to do some sort of firewalling. Then i would set up BGP in the Meraki SD-WAN and do eBGP towards your L3 switches in each DC. This would allow you to advertise both datacenter ranges down to the MX pairs. If one DC or MX pair fails your meraki spokes can still reach that DC through the other VPNC across your datacenter interconnects.   As for your active active question. Just advertise the unique ranges to your SD-WAN and do AS-PATH prepend, that should force clients to take the more direct route as long as your DC is up.     Why would my cellular backups at the branches be able to form a VPN with the HUBs in routed mode but not VPNC?  Something to do w/ auto-NAT maybe? Yes most likely a NAT issue. I would do a 1:1 NAT on your firewall towards the VPN HUBs Virtual IP. If you dont have IP addresses to spare, reserve a port and enter it manually in Meraki instead of using Auto-NAT.   Is it going to be possible to have branches form connections to both HUBs and send traffic to each?  Can the 2 HUBs send traffic to each other which essentially means there's a third connection between my datacenters? Yes, you can add both VPNC as hubs to your spokes. If you want NC and SC to use the closest DC, simply create two network templates where NC and SC has the NC HUB as priority 1 and NY as 2. Then make one for NY spokes and do the opposite. Yes, the hubs will build auto-vpn tunnels between them selves. ... View more

Then i would suggest that you open a support ticket or wait a few days to see if it solves itself. ... View more

Its for the transportation network within the VPN tunnel for BGP peering. For example, when you configure a VPN device, for example Cisco ASA with BGP over IPsec it uses APIPA addressing within the tunnel to establish a BGP session. I suspect that the same would work with Meraki S2S.   Try to add the Azure reserved APIPA space to the VNG setting called Azure APIPA BGP IP address Then add that APIPA range to your IPsec subnet config in Meraki as well and see where that gets you. Configure BGP for VPN Gateway: Portal - Azure VPN Gateway | Microsoft Learn   Note that i have not done this with Meraki before, but its worth a try 🙂   ... View more