This appears to be the fault of the AnyConnect client. I have disabled "Intelligent" inspection/SWG everywhere I could find it in the Umbrella admin, but I'm still having issues with users being able to access websites. I remoted in to one of the machines and lo AnyConnect is running its SWG... Trying to find a way to turn it off across the board so that users can get back to work but so far have only found a script (which won't run due to software restrictions), and a group policy setting which doesn't seem to be working for some reason. I also tried to manually stop the csc_swgagent service but also got permission denied.    There has to be an easier way I'd imagine but I cannot find it...   ... View more

Thanks for the reply.   Unfortunately I have tried this and also tried adding them to the specific whitelists but neither have fixed the issue.  ... View more

Sorry for the confusion...yeah, no SD-Wan needed if I can get the MPLS line working. Honestly don't care which, I just need the stuff to function. Being capped at ~5MB/s really causes users to get frustrated. The RDSH solution I setup as a stop-gap is better, but still not as stable as it should be.  ... View more

Ah, got it, sorry about that, this topic makes my brain melt.    Unfortunately I haven't had much time to mess around with the whole setup but I did plenty of messing around with the MTU on the SD-Wan problem. As soon as I can start playing around with the MPLS line to do some research, I will check MTU out first. That said, I thought MPLS operated on a different layer that shouldn't be impacted by a given MTU?    Also In case it wasn't clear, the reason we went ahead and got the the MPLS line was as a replacement for the SD-Wan connection--not planning on using SD-Wan at all if we can get the MPLS line to work efficiently.  ... View more

Just FYI: our setup is entirely hard-wired. No WiFi at all (we have wifi and allow users to use it but it is on an isolated network inaccessible to the work LAN where Meraki etc. lives).    Appreciate the input, though. Still have not found a solution unfortunately. We are still limping along with the SD-Wan users using Remote Desktop Session Host for this particular work.   This whole experience really has been like a terrible nightmare all around. What was supposed to save me time and frustration (paying a 3rd party like ATT to provide this service) has turned out to be the exact opposite. Triple the time wasted, quadruple the frustration, and we're left off worse off than we were before we signed up.  ... View more

Thanks. I have had a case open with Meraki for 2 weeks now trying to figure out the contract information. They emailed me today to tell me that they have opened the 3rd alternate case, this time definitely with the correct department and would be closing that ticket. No idea where it it...I don't see it in the account I have for the switches and the "support" page on the other ATT account brings me to an ATT page with cases of which none are Meraki so that's going well.   I also heard back from my ATT sales rep today who confirmed we aren't in fact licensed for AnyConnect so now I have to try and buy licenses somewhere. I have a separate Cisco/Meraki account for the 4 MS switches I bought when setting this all up because I thought it would be smart/helpful to be running Cisco/Meraki gear from the WAN to the LAN. So far, I haven't found a way to purchase them, searching Cisco's sight I keep landing in a frustrating loop of advertising, whitepapers and "try a demo" or "find a partner" pages...   As for the SMB issue, as mentioned, I did open a support ticket with Meraki (rather, ATT opened it because I can't open tickets directly with Cisco/Meraki for that service or that equipment [mx-95 and mx-68]). I drove 6 hours one way to our spoke location and spent ~5 hours on the phone with ATT/Meraki support trying to figure out what the problem was. At the end of the day, the final answer from the Meraki tech was that this was "expected behavior". i.e., tough luck, pound sand. ... View more

Thanks.  I know that the client can be downloaded from the Meraki AnyConnect page but the entire issue here is that what is available to download for me is an outdated version 5.1.6.103 which contains critical vulnerabilities. I'm trying to figure out how to resolve this. I cannot download from the linked Meraki download page because I don't have entitlement. It's an issue not just because it isn't good to be running vulnerable software, but our auditing software sees this and if affects our ability to get certifications.    Yes, the end users all have 1GB+ connections, but more importantly is the issue with the SD-Wan connection which is under my control and verified as having symmetric 1GB connections that work fine with other protocols. I have also used different connections (One Verizon Fiber and the other Comcast Cable both 1GB symmetric) on the spoke end and Dedicated fiber and Charter Cable on the Hub side.  I have also read and tried every SMB tuning help article out there and nothing has helped unfortunately. I have tried every MTA, smbdirect, smbmultichannel, etc. I also believe that if it were a problem with some fundamental Windows server setting, I wouldn't be getting ~270MB/s file copy speeds on the LAN between the same server and same model clients. I only get the 5MB/s limit when traversing the SD-Wan connection or the VPN.    ... View more

Thanks again for the replies.    Ah I see what you mean. I'm not sure exactly where the enablement is and as mentioned, I have kneecapped access to the Meraki admin since ATT is supposed to be managing things, but I do have the Client VPN page where I have set up the AnyConnect settings. Is this enablement etc. what is on the honor system? I'm certain we are paying for whatever licenses are needed for the VPN as I had to give a count of the number of users who would need VPN access. I really wish my ATT sales rep was as responsive now as he was before I signed on the dotted line... I have in fact contacted CISCO TAC but so far they haven't been able to help. Last I heard from them they opened a Meraki case on my behalf but couldn't find the case number.... I've spent hours and hours on the speed issue. Have symmetric 1GB fiber connections which all speed tests verify as on or close. Other formats work fine--SFTP, https downloads, etc. it is just SMB that is terrible. After hours on the phone with Meraki and ATT support, the bottom line answer I got was: this is expected behavior (in spite of hearing that others do not have this problem over and over here on this forum). At some point, I just have to get things working which is why I had the MPLS line installed but for some reason, if the Meraki equipment is connected, I still get the same terrible speeds which hardly makes sense (a laptop connected to each end of the MPLS line can transfer files via SMB between each other with no issues; once one end of the MPLS line is connected to a MS switch or MX router, it all falls apart).  ... View more

Thanks for the reply.  I have been patiently waiting for going on 3 weeks now for my ATT salesman to get me an answer or solution. So far he has just sent me the sales order on which there are no numbers that allow me to access downloads.  Not sure where “vpn is not included”, but we most definitely have that as part of the package. When going through the sales cycle, I made it abundantly clear that we have both the sdwan users as well as remote users/work from home users. VPN has been up and running the entire time (although I get the same terrible SMB speeds as the sd-wan connection gets) and have always connected via Secure Client. Honestly, I still don’t understand what if any difference there is between Secure Client and AnyConnect. I thought the latter was replacing the former (or vice versa), but this thread has me wondering if that’s correct. Is there another VPN client that I’m not aware of besides SC/AC? That is the only way I have ever been able to get users onto the VPN. I do understand that it offers more than just VPN connectivity but I can recall seeing a different VPN client.  ... View more

Thanks for the reply.   They make it frustratingly difficult to even see what is available.... I found a couple of pages like https://www.business.att.com/content/dam/attbusiness/briefs/att-sd-wan-with-cisco-product-brief.pdf  But it is essentially SD-Wan managed by ATT. That was the sales pitch. We got the highest package available which included Umbrella etc. This is what the sales guy sent me:   They were just launching Tier 3 which we ended up getting. The difficulty or breakdown seems to be that because it is "managed", things like full admin access are hidden from me and there doesn't seem to be a direct correlation between me and Meraki in terms of contracts etc. so I can't register to download patched versions of AnyConnect. I can't believe I'm the only customer asking for this but nobody seems to have an answer... ... View more

Thanks. Did you mean Secure Client? It looks like Cisco references "Secure Connect" as an umbrella term for their SASE and SD-Wan solutions:   That looks like the same page, and the Meraki devices and the software running on them that provide SASE/SD-Wan do indeed auto-update, but this is different than the VPN client. The VPN client is (was) AnyConnect which they are renaming or replacing with Secure Client. This is what I can't download or get to update.    Thanks again for the help. I've sent several follow-up emails to my AT&T salesman informing him everything I've heard from here, Cisco and Meraki support, etc. and it's been radio silence for several days (once again--this is typical). ... View more

@CptnCrnch @PhilipDAth  I'm certain that I remember when going through the sales pitch(es) with ATT that the VPN user count was part of the deal. What does that pay for? Can you even use Secure Client without a support contract? It seems crazy to me that regardless of support contract status Cisco would allow people to use their VPN products with old software that contain critical vulnerabilities.   Does the AnyConnect VPN software download section in the Meraki interface ever get its software updated? Or is it just forever stuck on whichever version was available when you first set everything up?   FYI this is what is listed on the sales sheet the ATT rep gave me:   ... View more

It has not been resolved for me. I still cannot get any SMB file transfers to happen faster than ~5MB/s at most. Usually hangs around ~1-3MB/s. I've spent 10+ hours on the phone with Meraki and ATT support trying to fix it to no avail. Not sure what other options there are--we're trying an MPLS line but are still having similar issues with that when it is connected to the Meraki equipment for some reason. I may end up just getting cheap netgear or whatever hubs to put at both ends of the MPLS line if I can't get it solved soon. I will report back if/when that happens.    And to be clear: this does not include solving for the same slow connectivity when people use AnyConnect Secure VPN client. All VPN users experience the ~5MB/s slow SMB file transfer speeds no matter what. Otherwise, I'm experiencing the issue on the SD-Wan connection to our single second location. Those users all have abysmal file transfer speeds over SD-Wan on 1GB connections (all speed tests show full symmetric speeds are being achieved).  ... View more

Thanks. I have and had that exempted as well (I haven't made any changes there in weeks) but something was still blocking it. I searched for the domain in the Reporting > Core reports > Activity Search and it always showed as "allowed" not blocked nor selectively proxied. This is what confuses me the most; it seems to consistently not report in Activity Search what is actually happening to the clients. Not sure why, but that has been the case multiple times.     ... View more

Possibly. I added it to every bypass/whitelist I could find and only the final step actually worked. Maybe I missed one? I have Health and Fitness (it is an insurance website so should fall in there) selected as Exempt in Intelligent Proxy/SSL selective decryption exemptions. File analysis is not enabled.    I also thought that adding the domain to Meraki UI > Security & SD-Wan > Threat protection > Umbrella protection > "Specify one or more domain names below (one per row) to be excluded from being routed to Cisco Umbrella." would completely bypass Umbrella but that didn't seem to work... ... View more

Thanks. No countries being blocked. Finally got it working via Umbrella External Domain and IP list. 😤 ... View more

It's mind boggling that I keep hearing this and from support I keep hitting dead ends. Are the users opening large files across the SD-Wan connection? i.e. are they running programs on their machines that open files on the servers/hub and do work and have it be performant? That is where my main issue lies--the users can browse/see the files fine, but when they go to open a file and do work, it is unbearably slow....this is how I discovered the issue. Trying to diagnose, I went to copy a file from the server to one of their machines and saw it was only getting ~5MB/s despite the 1GB connections, etc.    As a workaround, Iv'e set up remote desktop session hosts so they can run the software on the servers remotely and that works fine so RDP is OK, but it is finicky and still isn't ideal. We also have a couple of intranet sites that work fine as well, so it really just seems to be SMB. ... View more

Thanks. I think this is what the Meraki tech I was speaking to was kind of talking about but the problem is that the MPLS doesn't have it's own IP addresses. It is just a Layer 2.5 connection so there is no IP addressing--it's acting as if it is just a very long cat6 cable as far as I understand. Should I buy more equipment to put on either end? Or should I program the ports in the MS-125 and MS-120 that the MPLS line is connected to? I suppose I could set the Ports to a different VLAN? But the hub a spoke SD-Wan is set to automatic so on the MX-95 addressing and VLAN's is set to Single LAN as per ATT configuration to get SD-Wan working...I can set/create static routes, though, but again, no IP addresses on the MPLS line and I don't actually see a way to set an IP on the MS switch ports, just can set VLAN.  ... View more

Well, I did in a way that is how I ended up with the MPLS line. That was the "solution" to the problem. It may still be in a way, I was just hoping that I wouldn't have to replace all of the equipment. I can drive the 5 hours one-way back down to the spoke, plug everything into a dumb Netgear hub, then do the same up here at the hub. I didn't imagine that just continuing to use the Meraki switches would continue to cause the problem with the MPLS line in place.  ... View more

Thanks again for trying to help. I appreciate everyones input. I spent another 2 hours on the phone with ATT support Wed. and their answer was "we don't manage the MS switches so pound sand". So I created a ticket with Meraki. The engineer did his level best, but kinda came to the same result. He suggested hooking the server directly into the MX to bypass the switches. I couldn't do this and interrupt work, but I did plug in a laptop and set a share up on it. You guessed it: exact same result.    The network is dead simple. 2 Locations: Hub and spoke. 3 ISP at each end (spoke: Comcast cable, VZN fiber, Comcast MPLS); Hub: Charter cable, Crown Castle Fiber, Crown Castle MPLS (Comcast doesn't work in this area so had to use Crown Castle to terminate this end of the MPLS connection). I've tried using both ISP's at the spoke for the SD-Wan; they are both 1G connections; speed test verify. Also tried Charter and CC Fiber at the hub for SD-Wan. ISP doesn't seem to change anything.    Here is a simplified diagram:   Here is more detail (the above showing the troubleshooting with laptop hooked into MPLS line at the spoke).    Thanks again for everyone's help.  ... View more