I'm attempting to create a recovery process ahead of applying a firmware update to a switch stack consisting of two MS350's.  They are the only switches in the network.  Current firmware is 16.8.  Other switches in our environment have already been brought to a current or nearly current version.   The conditions I'm attempting to have a mitigation for would be: - a single switch in the stack experiences firmware corruption and will no longer function - both switches experience the above - the switch stack itself is corrupted somehow (if this is a possibility)   In the case where a single switch has failed, possible options might be: - physically uncable from the stack, connect to the Internet via a single uplink, and then factory reset.  Then recable to stack. - or just factory reset as it is   If both switches were to fail, possible options: - do one of the above procedures on each switch - in the Dashboard, remove the switches from the stack, delete the stack, disconnect the stacking cables and factory reset one at a time.  Then recreate the stack - would involve re-adding SVI's static IP's, etc.   For the third scenario, I'm essentially looking to find out if that even happens.   Thanks a lot           ... View more

Is anyone seeing similar traffic patterns like below on SD-WAN packet captures on an MX68W?     Are the private IPv6 addresses standard Meraki SD-WAN BGP? I'm seeing retransmissions like this in captures at multiple sites.         ... View more

We're determining the best way to implement default route and SD-WAN route failover in our network.  I've attached an image of our WAN topology.     Right now, an AutoVPN tunnel is formed between HQ and the Datacenter over the ASE connection.  The ASE connection is connected to a WAN interface on the HQ MX.  At the Datacenter, the ASE is connected to an MS350 switch pair that has an SVI for the vlan that traverses the link.   An outage involved losing internet connectivity at the Datacenter.  The HQ MX failed over to the other WAN port, but the only Hub specified was the Datacenter Hub and it was set for IPv4 default route.  Return traffic is directed via static route on the Datacenter core switch to the SD-WAN Hub there.  The DC Edge firewall, SD-WAN Hub and Core switch were all unable to connect to the Internet and the Meraki Registry.  We had no Internet connectivity at HQ via the fail-over circuit until we disabled the IPv4 default route check box in Site-to-Site VPN there.   So that failover is automatic - should the Azure vMX Hub be set as a secondary Hub for HQ and with IPv4 default route disabled for it? Would it be advisable to remove the SD-WAN tunnel over the ASE between HQ and the Datacenter and simply use the ASE as a L2 link that it's intended for?     Here are some notes regarding the sites and equipment:   Primary sites:   HQ site Connected to the Datacenter site via a private circuit (ASE) Secondary public internet connection available for failover SD-WAN spoke utilizing private circuit as primary uplink   Datacenter site Hosts many VM's and through which the HQ reaches the Internet One MX pair is the edge firewall and another pair is a one-armed VPN concentrator Edge firewall pair provides for Client VPN   Azure tenant Hosts SQL databases and some VM's   Small branch sites Connect to Datacenter over SD-WAN     From Upstream to Downstream this is our topology:   Datacenter site Edge MX250 pair: -WAN 1 primary uplink which provides Internet inbound/outbound -Utilizes two VLANS, management and DMZ -Not participating in SD-WAN   Core switch MS350 stack pair: -Static DFG of Edge MX250 LAN -SVI provides the default gateway for HQ's primary uplink and L2 connectivity for both the public Internet circuit and the private circuit back to HQ   One-armed VPN Concentrator MX250 pair: -All RFC-1918 is statically routed here from the Core switch -Hub for all sites -Hub is also the IPv4 DFG for HQ   Private circuit (ASE) connects HQ site via L2…   HQ site HQ Core Switch Cisco Catalyst: -L2 Connectivity for private circuit and for secondary public circuit -L3 for HQ site -Transit vlan to site's MX firewall's LAN   MX250 Firewall pair: -SD-WAN spoke -Datacenter's Hub is specified as only Hub and is the IPv4 DFG -Private circuit to DC is the primary Uplink -Public circuit is secondary (1/5th bandwidth of private circuit) ... View more