Well I found a solution that worked for me.  I wouldn't call it elegant, but at least it was effective.  During my normal maintenance window, I put the new MX in production, and took out the NATs I had defined.  Had to remove the NATs temporarily due to the MX not allowing a NAT on a primary IP.  I then set the primary IP for the WAN to the eventual public IP addresses that I will end up using through the NATs.  Had them in place at most 60 seconds, which allowed the MX to force update the ISP ARP tables to these IP addresses on that hardware address.  After about 5 mins work, I had the primary IP back on the WAN, and redefined the NATs.  Worked perfectly.  YMMV. ... View more

I personally would LOVE a connectivity reporting page with info on all WAN connections.  I currently use the MSP Portal Overview with the map, on a browser with a 4min 59second refresh on my wall of monitors (along with weather and another monitoring tool) for our coverage desk.  The refresh was needed to get around the 5 min inactivity logout.  However, that MSP Portal page doesn't indicate if a connection has switched from WAN1 to WAN2, just if total connectivity is down on any Meraki device.  Our WAN2 being a cellular, i.e. expensive, backup connection, staying on that connection for long periods of time can get pricey, so we like to fix the WAN1 issues quickly.  Any ideas on how to accomplish that would be great.  I've tried pinging the dynamic host name, but that usually doesn't go down for more than a minute or two if the WANs fail over.  And, there is a status e-mail that states this, but it comes in a sea of other status e-mails from Meraki and other products so fishing through that is a massive forest rather than a single screen status indicator. Seems like such a simple thing, but so far has been difficult to find/create.  SNMP seems like a avenue I should look, but I'm not familiar with setup of an SNMP tool, so something easy would be helpful. ... View more

Wow, almost a decade down the road and this is still a problem.  I only have a 2 hour window normally.  I've ask the ISP to clear the cache, but for some reason that didn't work either.  It took almost 24 hours for a test setup to work, my production environment will hate that. ... View more

I may have found out something about the 1:1 NAT.  Apparently the 1:1 NAT will not even try to work if the destination is not in the ARP table of the Meraki.  And, in my case the destination device didn't seem to fill the ARP table in my short testing window.  After trying another destination device, it started working about 24 hours where it did not initially upon setup.  Very strange it takes so long to update the ARP table. ... View more

Major update to my issue (fingers crossed).  My Meraki MX250 setup is still not in production, as I really can't move it there until I get this particular issue with 1:1 NATs fixed.  I was starting to think the issue was based on 1:1 NAT problems.  A Meraki engineer found that my internal server was not showing up on the ARP table (this was a day after the last test hour I used to fix this.)  And, stated that a 1:1 NAT won't even try to work unless the destination is in the ARP table.  I'm wondering if there is a length of time needed for some machines to properly be entered into the ARP table on the Meraki?  I usually only have about 1 hour of time for testing production equipment (i.e. allowed down time) and within that time my testing of the final production destination machine never answered calls.  However, I put a simple IOT device into the test environment that the Meraki is currently in, and it also failed 1:1 NAT setup calls to port 80 and 443 initially.  But, I left it there and after 24 hours I tried again and it worked.  I can't say the amount of happiness of this discovery is overcoming the frustration in getting to this point is a positive for me yet.  But, hopefully I can find a way to setup my Meraki into production with the final destination in place and working.  I just don't know 1. why the machine didn't show in the ARP table within the 1 hour, and 2. how long should it take? ... View more

I'm fighting NAT 1:1 rule failure on a an MX250 right now, and 18.210 didn't seem to help any over any older firmware. Our problem: public IPs (not actual, but close representation)  WAN1   10.0.0.1/28 gateway   10.0.0.2 main IP   10.0.0.3 secondary IP for certain traffic NATed to 192.168.0.11 (this works perfectly on legacy non Meraki router)  WAN2   11.0.0.2 main IP - 1:1 NAT setup for LAN IP 192.168.0.11 to 10.0.0.3 port forwarding port 80 for non-secure informational data. - of course normal port forward doesn't do anything since the traffic is not incoming on 10.0.0.2 - zero traffic allowed to or from 192.168.0.11 with 1:1 NAT turned on for 10.0.0.3 - outbound only traffic is good from 192.168.0.11 with no NAT or 1:MANY NAT (tried 1:MANY just for fun.) but still no incoming traffic allowed. - Contacted ISP to clear ARP tables, still no traffic incoming. With input from Meraki Support, we tried a number of scenarios, including messing with traffic shaping, and flow preferences.  Very confusing as to why with NAT there is no incoming traffic allowed no matter what inbound ports are defined to allow traffic from a non-primary IP that still within the subnet.  Seems like a serious Meraki bug that needs attention. ... View more

Hi DonaldB, My stack is 100% Meraki too (though the legacy device I need to use until this is fixed is not Meraki)  I've not tried the reboot thing, I will give that a shot.  I also just right now updated to firmware version 18.210, which is not fully released yet but has a number of traffic flow fixes.  I'll give it a new attempt this weekend, fingers crossed. Edit, the device in question serving the port 80 calls is on one of my MS250 switches, I'll play with putting directly on the MX250 too this weekend. ... View more

I'm having what is likely a very similar issue.  New MX250, trying to forward standard port 80 traffic internally to a device.  It works just fine on another brand router, and on many MX67s I use elswhere, but not on the MX250.  New VLANs have been defined, but the device in question is currently only set to the default 1 VLAN. ... View more