Meraki

from_afar · ‎Apr 5 2024

Thanks very much. I'm limited in what I can see/admin as I'm going through ATT for the service, but I can see the appliance uplink page. The Hub shows no loss, the spoke shows a couple of tiny (<1%) spikes over the last day. The Latency for the hub is steady around 3.5ms and spoke 8ms. Here is the spoke appliance uplink graph over the last day: are those tiny loss spikes enough you think to cause these kinds of issues?

from_afar · ‎Apr 5 2024

Not that I can see. Would that show in the event logs? I see "sent unexpected packets" every once in a while but nothing about packet loss in the event logs.

from_afar · ‎Apr 5 2024

We have a single Spoke and Hub SD-Wan set up with only the one spoke and the hub. The hub users connect to Windows machines on the hub LAN to work (open files to work on them in various programs, group policy, printers are all on these servers) and there seems to be connectivity issues sometimes. Some programs crash. Some print jobs crash or take a long time or duplicate. Some of the errors I've seen point to connectivity issues with the server on the hub. The only events I see in the Spoke's event logs are DHCP events and SNORT update, nothing about connection errors. Any ideas where I could look or what might be causing these issues? Thanks.

from_afar · ‎Mar 8 2024

We are licensed for Umbrella SIG Advantage and are in the process of setting things up. I have fired up the 2 local appliances and have DHCP setting those as DNS for everyone. However, instead of getting block pages, there are still a lot of blocks that result in the page just timing out. This made me wonder: if using Umbrella, should I get rid of all of the Category blocks and threat protection settings on the MX devices? We have yet to set up the Network tunnel so for now are just testing DNS, but was curious what other people have done.

from_afar · ‎Feb 21 2024

I contacted the NOC and they couldn't help me. It looks like they (AT&T) enabled Umbrella and I haven't had the chance to set up the local appliance yet so all DNS was failing. I disabled Umbrella and things are working again. Thanks for the quick reply.

from_afar · ‎Feb 21 2024

I started getting messages from users this morning that connecting to AnyConnect, they all of a sudden cannot access resources. I tried connecting myself, and when the VPN is active, I get a Non-existent domain error with nslookup. Connected locally, everything works fine. All dns servers are up and running. The adapter says "unidentified connection" as well. I can ping the dns server when connected, though. Any idea what could be causing this issue? I have not made any changes to any of the settings and things worked fine yesterday.

from_afar · ‎Feb 12 2024

Good call. That seems to be what happened. Strangely, in the switch config interface, it did have a correct subnet IP assigned as DHCP, but when clicking the edit button, I can see the static configuration. I wonder if this static config kept the device from reaching the internet and getting the correct new config from me? But if that were the case, it would seem that the device wouldn't be manageable at all. I would have thought that a factory reset would have wiped the previous config and prevented it from retrieving the old config completely. Is there another way to reset the device that completely wipes it? Thank you!

from_afar · ‎Feb 11 2024

I replaced a couple of MS120 with MS125 over the weekend and I'm seeing an odd error. I bought them refurbished and it seemed the old owner didn't remove the config. When I plugged them in, I couldn't get anything to work. So I pushed the reset buttons for ~5 seconds and then things started working,. However, I'm now seeing strange things in the event log. I'm getting a ton of "extra: no_offers_received, vap: 0, vlan: 100" errors. I do not have a VLAN 100: and I am not using a 10.110.x.x subnet anywhere, but it seems the devices both have 10.110.x.x addresses: I'm running a DHCP server on the network, and there are plenty of addresses available. Allow DHCP servers is set and there is only the one on the network. It seems like what happened is that the MX95 saw the original config on the MS125's and after resetting them, it didn't recognize that things have changed. Is there any way to force the system to re-check the setup and get the correct IP addresses/VLAN's? Thanks.

from_afar · ‎Feb 9 2024

It seems that it's not possible to delete clients from the interface. As such, is it then OK to ignore IP conflict event logs for devices that have had their IP address changed and/or are no longer part of the network? I have a NAS device that has 4 NICs. I had the device connected via a couple of the NICs as I was setting everything up and I eventually created a BOND on the NAS with several NICs combined. Since then, I have been seeing ip conflict entries in the event log because Meraki sees that the new bond IP address is the same as one of the previous individual NIC addresses. Is it OK to ignore these events? Or is there a way to remote old clients from the system that I have missed?

from_afar · ‎Feb 7 2024

Thanks for the reply. As mentioned, this is a super-simple setup--just the one hub and one spoke and configured as "single lan", so not using any VLANs outside of that. Sounds like I'm just seeing the content filtering happening on the device being logged and the traffic is flowing as expected.

from_afar · ‎Feb 7 2024

Thanks for the reply. The setup is very simple: just the one hub and one spoke. I indeed do have the hub configured with the IPv4 Default route checkbox checked: The Main subnet at the spoke location does have VPN mode enabled as I was connecting there to do some testing. Should this be disabled? Nobody needs to VPN in to the spoke location so it's not needed except for testing. Edit: actually, to test, I just VPN'd into that location and when the VPN is active, checking my IP address shows the correct HUB IP. Would the AnyConnect VPN be different than the SD-wan?

from_afar · ‎Feb 7 2024

I have a hub and spoke set up with one hub and one spoke. I thought I had set everything up so that all traffic would egress WAN1 (unless failover) of the hub. However, when I look at the event logs for the spoke location I can still see a lot of entries of content filter blocking. The SD-Wan is set up in a single LAN hub-and-spoke configuration; load balancing is disabled; Active-active autoVPN is disabled; and there are no Local Internet breakout rules defined. Am I mis-reading things? Does the fact that there are entries in the event log for that location not necessarily mean there is traffic exiting to the internet from that location and it is just blocking there instead of at the hub? I did set up content filtering on the spoke device just in case traffic got out that way, but I expected that the actual filtering would all take place on the hub where the actual traffic was hitting the internet. As a test I added a domain to the whitelist on the hub that someone at the spoke needed to access and after a few minutes, they still could not reach the site and I could see the entries of the blocking in the event log in their location so I think that proves that they are indeed able to get to the internet directly and it's not just pre-filtering on their device and still exiting the hub. Have I missed some config somewhere that would force all of the SD-Wan spoke/branch traffic to exit through the hub? Thanks.

from_afar · ‎Feb 5 2024

That certainly would explain it 😑. Thanks very much for the help...

from_afar · ‎Feb 5 2024

I understand that you can get to config pages via switch.meraki.com, but I'm not clear how it works if you have multiple switches. Is there a way to talk to a specific switch via switch.meraki.com or is the only option to plug directly into the management port?

from_afar · ‎Feb 5 2024

I have a couple of MS120-48Lp switches and I bought a MX425-16 for our 10G NAS devices. I seem to have an issue where no matter what kind of SPF+ cable I use, I cannot get the MX to talk to either of the MS switches. If I plug a SPF ethernet adapter in to the MX and run the ethernet to one of the non-SPF ports on one of the MS switches, everything seems fine. I've also tried using SPF adapters in place of SPF cables, but still cannot get the MX to talk to either MS via SPF -> SPF. Is there something that needs to be configured for this to work?

from_afar · ‎Feb 5 2024

Thanks very much, Gary. I got the core deploying correclty which is I guess a good start. At least I can get people working. I will review the link on combining the packages--I really would prefer to take advantage of all of the security offerings available. I learned the hard way about NAM 🙂 Completely broke networking on most of the machines I deployed it on. Once uninstalled/installed without, things seem to be working fine. Interesting to hear ISE might cause trouble as well--I will leave it out going forward--thank you!

from_afar · ‎Feb 1 2024

I could but as I said I'm unfamiliar with deploying where there are multiple msi's involved. I could deploy just core, but then I'd still have to install Umbrella, ZTA, etc. manually.

from_afar · ‎Jan 30 2024

Probably. I've done it with other softwares. Just not sure how it would work with all of the extra packages (Umbrella, ZTA, ISE Posture, etc.) with IntuneWinAppUtil.exe. I suppose I could just run core and not worry about the other stuff. I'm also a tiny bit hesitant as I'm supposed to be getting Umbrella API keys to enable Umbrella which may offer a better user experience for users to VPN in. If there is a guide to deploying the Secure Client via intune that you know of, I'd love to check it out.

from_afar · ‎Jan 30 2024

Thanks for the reply. Yes I've tried the downloadable from dashboard version and it seems to work OK if I don't install the Network Access Manager (if that is installed, some laptops, seemingly at random, will have their network access completely broken--it will consistently fail at "getting IP address" when they try to join their WiFi networks. Found a bug for this on Cisco site but was marked as "unable to reproduce"). The issue with this version is that I have to remote in to install it on all of the clients whereas the Store version can be installed by the user via Company Portal which makes things much easier.

from_afar · ‎Jan 29 2024

I'm trying to get my users set up with Anyconnect so they can VPN from home. I started by using the exe that can be downloaded from the dashboard, but discovered the Windows Store Version allows install from Company Portal via Intune which is much easier. However, I've run in to an issue with each of the several Win 10 (fully patched) machines I've tried/installed it on. The connection opens and seems to work for a few minutes but consistently drops after no more than 5 minutes. The even logs all look the same: Jan 29 14:24:38 loc1-exmpl1-lt-vpn AnyConnect VPN AnyConnect VPN client connected local_ip: 192.168.112.168, user_id: homer.simpson@example.com, remote_ip: 12.34.56.78 Jan 29 14:24:33 loc1-exmpl1-lt-vpn AnyConnect VPN AnyConnect VPN client disconnected local_ip: 192.168.112.168, user_id: homer.simpson@example.com, remote_ip: 12.34.56.78 Jan 29 14:18:23 loc1-exmpl1-lt-vpn AnyConnect VPN AnyConnect VPN client connected local_ip: 192.168.112.50, user_id: homer.simpson@example.com, remote_ip: 12.34.56.78 Jan 29 14:18:18 loc1-exmpl1-lt-vpn AnyConnect VPN AnyConnect VPN client disconnected local_ip: 192.168.112.50, user_id: homer.simpson@example.com, remote_ip: 12.34.56.78 Jan 29 13:16:05 loc1-exmpl1-lt-vpn AnyConnect VPN AnyConnect VPN client connected local_ip: 192.168.112.13, user_id: homer.simpson@example.com, remote_ip: 12.34.56.78 Jan 29 13:16:03 loc1-exmpl1-lt-vpn AnyConnect VPN AnyConnect VPN client disconnected local_ip: 192.168.112.13, user_id: homer.simpson@example.com, remote_ip: 12.34.56.78 Jan 29 12:57:21 loc1-exmpl1-lt-vpn AnyConnect VPN AnyConnect VPN client connected local_ip: 192.168.112.168, user_id: homer.simpson@example.com, remote_ip: 12.34.56.78 Jan 29 12:57:19 loc1-exmpl1-lt-vpn AnyConnect VPN AnyConnect VPN client disconnected local_ip: 192.168.112.168, user_id: homer.simpson@example.com, remote_ip: 12.34.56.78 Jan 29 12:57:00 loc1-exmpl1-lt-vpn AnyConnect VPN AnyConnect VPN client connected local_ip: 192.168.112.50, user_id: homer.simpson@example.com, remote_ip: 12.34.56.78 Jan 29 12:56:59 loc1-exmpl1-lt-vpn AnyConnect VPN AnyConnect VPN client disconnected local_ip: 192.168.112.50, user_id: homer.simpson@example.com, remote_ip: 12.34.56.78 Jan 29 12:56:40 loc1-exmpl1-lt-vpn AnyConnect VPN AnyConnect VPN client connected local_ip: 192.168.112.13, user_id: homer.simpson@example.com, remote_ip: 12.34.56.78 Jan 29 12:56:38 loc1-exmpl1-lt-vpn AnyConnect VPN AnyConnect VPN client disconnected local_ip: 192.168.112.13, user_id: homer.simpson@example.com, remote_ip: 12.34.56.78 Jan 29 12:35:37 loc1-exmpl1-lt-vpn AnyConnect VPN AnyConnect VPN client connected local_ip: 192.168.112.168, user_id: homer.simpson@example.com, remote_ip: 12.34.56.78 Jan 29 12:35:33 loc1-exmpl1-lt-vpn AnyConnect VPN AnyConnect VPN client disconnected local_ip: 192.168.112.168, user_id: homer.simpson@example.com, remote_ip: 12.34.56.78 Jan 29 12:02:41 loc1-exmpl1-lt-vpn AnyConnect VPN AnyConnect VPN client connected local_ip: 192.168.112.50, user_id: homer.simpson@example.com, remote_ip: 12.34.56.78 Jan 29 12:02:40 loc1-exmpl1-lt-vpn AnyConnect VPN AnyConnect VPN client disconnected local_ip: 192.168.112.50, user_id: homer.simpson@example.com, remote_ip: 12.34.56.78 Jan 29 12:02:12 loc1-exmpl1-lt-vpn AnyConnect VPN AnyConnect VPN client connected local_ip: 192.168.112.13, user_id: homer.simpson@example.com, remote_ip: 12.34.56.78 Jan 29 12:02:10 loc1-exmpl1-lt-vpn AnyConnect VPN AnyConnect VPN client disconnected local_ip: 192.168.112.13, user_id: homer.simpson@example.com, remote_ip: 12.34.56.78 Jan 29 12:01:26 loc1-exmpl1-lt-vpn AnyConnect VPN AnyConnect VPN client connected local_ip: 192.168.112.168, user_id: homer.simpson@example.com, remote_ip: 12.34.56.78 Jan 29 11:55:14 loc1-exmpl1-lt-vpn AnyConnect VPN AnyConnect VPN client connected local_ip: 192.168.112.50, user_id: homer.simpson@example.com, remote_ip: 12.34.56.78 Jan 29 11:49:34 loc1-exmpl1-lt-vpn AnyConnect VPN AnyConnect VPN client connected local_ip: 192.168.112.13, user_id: homer.simpson@example.com, remote_ip: 12.34.56.78 Jan 27 15:06:28 loc1-exmpl1-lt-vpn AnyConnect VPN AnyConnect VPN client disconnected local_ip: 192.168.112.13, user_id: homer.simpson@example.com, remote_ip: 12.34.56.78 which isn't super helpful. I've tried running a packet capture on that machine on Anyconnect, but that doesn't seem to work either (as soon as I hit "start capture", it downloads a 0byte file, then stops doing anything). If I try to download after stopping capture, I get a "failed to connect to server" error message: Not quire sure what is going on. Is there a setting I'm missing that would reconnect the Windows VPN automatically or something? Or should it be more stable than this?

from_afar · ‎Jan 20 2024

As it turns out, I had the devices set with a different default gateway than the LAN ip the MX was using. Changing the default gateway (or the LAN IP) fixed the issue. Thanks to @Ryan_Miles for the help!

from_afar · ‎Jan 20 2024

@Ryan_Miles wrote: Not sure if your diagram and original post have typos or if you're just giving example IPs. Your HQ site is subnet 192.168.111.1/23. But you're mentioning a 192.168.11.x subnet? Your VPN client gets an IP on subnet 192.168.112.0/24. If you do actually have a 192.168.11.x subnet at HQ it's not on the MX and would exist on some other router device we're not aware of. And the MX would need a route to that device (and that device a route back to the MX). My existing network has that address space so I'm testing things now using that address so I can plug the MX95 into the existing infrastructure and have things work. Is there a better way to do things? I already have Windows DHCP and a ton of stuff using that address space so changing things over would be a nightmare...If I used some other IP address, would I have to create routes to all of the existing devices on the network? I also noticed that from the Meraki dashboard I can ping the NAS and http server, so it seems like a routing issue.

from_afar · ‎Jan 20 2024

Also, I did try setting VPN to enabled but get the same result unfortunately. I suppose a simpler way of asking the question is: if I have an existing network 192.168.11.0/24, how would I set up the hub and spoke and AnyConnect IPs so that the AnyConnect and Spoke machines can reach the devices on the 192.168.11.x subnet?

from_afar · ‎Jan 20 2024

Yes, sorry, typo in the image--fixed now. Dealing with 192.168.11.x and 192.168.12.x. I don't see the 112.0/24 though?

from_afar · ‎Jan 20 2024

Thanks for the reply. I understand it is a lot of info and I did a bad job explaining. I didn't see a way to attach an image when creating the post, but added one to the above reply showing the layout. I don't think I gave the settings for the spoke network, just HQ and AnyConnect since that's what I'm trying to troubleshoot at the moment (assuming if AnyConnect works, hopefully the spoke will too).

About from_afar

from_afar

Community Record

Badges