Hi rbnielsen, your post is interesting. I'm facing the same issue with vMX and VPN Client. The only way to make it work is with IP Basic SKU? Or, is there any other alternative?. Please let me know. Have a great day. Regards. David ... View more

Hi Jabettan, just one doubt. If the MPLS is connected to a LAN port, Can I use that LAN port to establish a VPN tunnel over the MPLS circuit?   Regards.   David Lima. ... View more

Hello Fady, of course you can.   Currently, our Switch C4507(with redundant Sup) acts as a DHCP server, default Gateway and ip routing. It has almost 30 Vlans, It has connected 3 MPLS Firewalls and 10 remote sites through fiber optic. Well, I can say that it is our core switch for my network.   Your suggestions are always very welcome.   Regards.   David Lima.       ... View more

Hi Philip, I'm completely agree with you. Use routing policy  is a lot of work. I also have a case opened with Meraki.   I'm still waiting an update if there is a way to overcome this, I mean if there is way to keep the C4507 as a default Gateway. I'll keep in touch with you. Regards. David Lima. ... View more

Hello Fady and Philip. First of all, I want to thank your time to both of you.   Here is an update: Regarding your suggestions:  Keep the switch as your DHCP. (Done)  Configure the MX and switch connection to be trunk. (Done)  Have the VLANs also configured on the MX. (Yes, done)  Use the default gateway to the MX. (It Works if the default Gateway is the MX, but my goal is to keep the C4507 as the default gateway)  Then apply the group policy. (Done) Tracked users by IP address (Done) RESULT: The group policy applied per Vlan is still not working :(.   Please see the diagram picture.   The Switch C4507 has an ip default route pointing to MX Vlan1 IP address (10.2.0.19): ip route 0.0.0.0 0.0.0.0 10.2.0.19.   If I change the ip route to point to MX Vlan118 IP address (10.2.118.19): ip route 0.0.0.0 0.0.0.0 10.2.118.19. Then, the policy group applied for the Vlan 118 Works fine.    As a temporal test, I'm doing a route-map for Vlans 1, 113, 118, so the next hop will be the MX Vlan ip address. The first result is that the group policy applied per Vlan is working. Vlan 1: 10.2.0.0/24 -> Next hope 10.2.0.19 Vlan 1: 10.2.113.0/24 -> Next hope 10.2.113.19 Vlan 1: 10.2.118.0/24 -> Next hope 10.2.118.19   Weird? I know, but I can't find another way to make it work if I want to keep the C4507 as the default Gateway. Any suggestion will be very appreciated. Very best regards.   David Lima.     ... View more

Hi Fady, thanks for your time to answer. I can confirm that the switch port that is connected to the MX is configured as a trunk mode. I think the connection is simple: Internet --- MX100 ---- C4507(DHCP)---PC I have 5 Vlans created and this issue is happening with every vlan created in MX100. If DHCP is MX100, the PC is tagged correctly to each Vlan and content filtering is working perfectly. But I want that C4507 acts as a DHCP server for all my network. Also, the C4507 is the default Gateway for the PCs.   --- C4507E --- ip dhcp pool VlanTI  network 10.2.118.0 255.255.255.0  default-router 10.2.118.51  option 150 ip 10.2.100.10  dns-server 10.2.0.102   interface GigabitEthernet1/22  description -- MERAKI MX100 --  switchport mode trunk  no logging event link-status   interface GigabitEthernet1/36  switchport access vlan 118  switchport mode access  no logging event link-status   I've opened a Case 02890362 If you want to take a look for more details. Best regards. David Lima. ... View more

Hi Philip, thanks for your suggestion.   In a production environment, It will be a Little hard because I have almost 60 Vlans. I think there should be a way to keep the C4507 as a DHCP server.   If you have any suggestion, please let me know.   Have a great weekend.   David Lima. ... View more

Hi Philip, thanks for your time.   I think i found something:   1. When our Cisco Switch C4507 acts as a DHCP server.     - The MX client monitor tool, shows the following for a client that is configured in a vlan 118:  Network IPv4 address: 10.2.118.40 MAC address: 88:5a:92:27:a7:ff VLAN: 1 — Default Port forwarding: none 1:1 NAT IPs: none    - The result is that the user can Access Internet without restriction because Vlan1 hasn't a group policy applied.   1. When MX100 acts as a DHCP server.     - The MX client monitor tool, shows the following for a client that is configured in a vlan 118:  Network IPv4 address: 10.2.118.84 MAC address: 70:28:8b:e6:dd:8d VLAN: 118 — Vlan118-TI Port forwarding: none 1:1 NAT IPs: none   - The result is OK, because the user can Access to Internet and is limited by the group policy applied per VLAN.   I don't know if DHCP configured in our switch C4507 need an special code, like phones (option 150).   Any advice will be appreciated.   Regards. David Lima.            ... View more

Hi Fady. Thanks for your comnents.   The policy group are applied under each Vlan, I also restart de MX but same result.   The content filtering only works if I apply the group policy per client.   The switch C4507 acts as a DHCP server for all the Vlans.   I hope you have some clue.   Regards.   David Lima.     ... View more

Hi Philip, thanks for your answer. I'm applying the GP to the VLAN.   Regards. David  ... View more