actually I´m also trying to understand how this scenario/design would work 😕 @Brash you mentioned that in your setup you´re using a MX in Concentrator mode acting as Hub next to the Umbrella SD-WAN connectors and advertising IP-Prefixes with the longest match to get the traffic routing correct to the spokes, right? What´s about the connectivty between the Spokes? Is that traffic routed through the Default-Route via the SD-WAN connectors or isn`t there traffic flowing between your Spokes? What I´m currently struggling with is to understand if it`s a possible setup to use a Full-Meshed Auto-VPN (where all MXs are used in Routed-Mode and as Hub) with Umbrella SD-WAN Connectors as so called "Exit- or Edge" Hub to the Internet... is this possible with that kind of solution or maybe Secure+ Connect can solve this design consideration? ... View more

if I`d understood the documentation (linked by @PhilipDAth) correct, than the order should be... enroll -> define tags -> create profile -> add settings profile -> apply profile   Solution Deployment Concepts The following key concepts will be helpful in understanding how to set up your Cisco Meraki Systems Manager environment. Thinking about these steps beforehand will simplify initial deployment and ongoing management. Enrollment: When devices enroll into Systems Manager, they give you full device access for setting user restrictions, managing applications, and enabling device visibility and management. Tags: Systems Manager uses tags to verify that the right devices get the right applications, profiles, and restrictions. Tags can be applied manually, automatically, and even dynamically, based on a device’s status. Profiles: Profiles control device configurations and enable or restrict device access, depending on the use case. Applications: Systems Manager enables application delivery and management through public app stores and custom applications hosted in a cloud-based repository. Security: Security-solution sets within Systems Manager include securing the device itself, verifying that only secure corporate applications are installed, and processes to wipe data in the case a device is lost or stolen. Troubleshooting: Systems Manager has built-in tools to troubleshoot mobile and desktop devices. ... View more

but there is an important thing to notice! the difference in using a Group-Policy with Layer3 Firewalling is, that the behavior is stateless while it`s stateful doing it on the firewall page of the Security Appliance! ... View more

@Bruce using the WAN 1 as 802.1q trunk port is it therefore necessary too to define a specific VLAN-ID under the MX uplink settings or will the MX in 1-armed mode use that port as trunk with native/untagged VLAN-ID: 1 anyway? ... View more

honestly speaking at the moment I don`t know what the cause of the problem is, I´m responsible for the WAN and only got the information that there are interruptions over the Auto-VPN connections! So, no clue if the Meraki Software is the reason or if the access in the underlay which is hybrid (MPLS and Internet) is overloaded with bursty traffic... it`s really frustrating that there`re no helpful informations on the dashboard to troubleshoot that in a serious manner 😠   thank you @alemabrahao for the hint with the software - I´ve checked back and all MX´s are currently using 18.107.2 - so I´ll follow your suggestion and open a support-case! One more question to you regarding the downgrade to 17.x... did you get more or detailed informations in the response, in regard of what was the problem in your case with 18.x? ... View more

easier said than done... first of all as already replied to @RaphaelL it`s really difficult to handle that kind of problem with the packet capture on the dashboard, because the problem occur only sporadically and for a short period of time (user reports that the session had disconncted and automatically re-connected), so when to start the capture? Next thing, what will I see in the capture? If a performance related problem and the Application is running over TCP/3389 than maybe restransmissions and out-of-order packets followed by Resets , but the cause of that remains still unclear ... View more

@PhilipDAthwe´ve already licensed MI but as you mentioned, only Web Apps are supported here but I´ve to deal with the native RDP application from windows ... View more

@RaphaelLI think that would be the best way to figure it out, but my problem is that the issues occur sporadically and so fast... what is really difficult to handle with the packet capture on the dashboard! In my opinion it`s also hard to analyze and find out in behalf of the Capture-files if potential performance problems are the cause of the problem and of course what traffic is the reason for them ... View more

@alemabrahaoI know that documentation, but unfortunately I´m not sure what you mean exactly what could help me with that - finding out what causes the interruption? ... View more

so just as I had already thought! no matter how many different entries are defined in one rule, it`s an OR behavior and the entries are not dependent on each other! hm, hasn't any of you had such a requirement so far? ... View more

I´d like to ask one more question regarding that topic... I always thought that in the Phase2 of a Site-to-Site VPN connection the parameters like the Local- and Remote IP-Subnets have to match on both VPN-Peers which should form the tunnel?! How does the Meraki MX know which local IP-Subnet the remote site VPN-Peer will need to know or is the MX sending all "enabled" VPN Networks in the Phase2 for a SA? If so, isn`t this a potential security issue when peering with Non-Meraki VPN peers? ... View more

OK, thanks for clarification! ... View more

yes, correct! @GreenMan @maybe you‘ve a suggestion how the cabling should look in such a case too? ... View more

@GreenMan absolutely correct - sorry, I´d a wrong assumption... maybe you can also help me understand how the cabling between ISP Routers <-> Switches <-> MXs should look like when each ISP provides 2 upstream routers (e.g. Active/Backup)? ... View more

hi @alemabrahao thank you for your respond! I´ve readed already through the official public documentation, but unfortunately I was`nt able to find helpful information regarding my requirement... 😕 ... View more

would`nt it be "better" to connect both links of MX-1 Primary to the Switch connected to ISP 1 and the two uplinks from MX-2 to the switch for ISP 2 and implement a link (or e.g. LACP Channel) between the outside transit switches? ... View more

MX = 17.10.2 MG = 1.11 ... View more

Hi all, @RaphaelL thank you for sharing all the informations in the community!   I´ve a behaviour regarding PMTU discovery with the MX in conjunction with a Meraki MG - where the MG is sending ICMP Type3/Code 4 back to the MX WAN Interface - because the Host behind the MX is sometimes sending packets larger (DF-Bit set) than the MGs MTU is BUT it looks like the MX isn`t providing that ICMP informations back to the Host, so the client could react on this and probably adjust... The Auto-VPN Tunnel itself is working fine without interruption or connection loss!  Maybe someone is aware of that behaviour? ... View more

thank you @alex_n ! I absolutely cannot understand why a known problem is not listed in the release notes... I probably could have saved myself all the troubleshooting, really annoying! A workaround or something known to you what could make it work in the meantime? ... View more