Hi to all, I´m also noticing that "problem" in one of my networks but till now I could`nt find a problem on the physical lines or cpe-routers 😞 could probably the NAT- which is done on a 3rd Party Firewall before the 1-armed-concentrator be the problem? if so, what`s the best way I can troubeshoot that? ... View more

Hi,   I´d like to ask several questions for understanding about that topic "management vlan" 1 - reading through the documentation Advanced MS Setup Guide - Cisco Meraki I understand, that the configuration can be done either "Globally" via the Switch Settings or "per Switch" -  so is my understanding correct, that when e.g. globally Vlan300 is configured and per Switch it`s Vlan400 it the globally configuration will be overruled and a notification appears under the device that the configured Management VLAN is`nt matching correct between globally and per Switch locally as well? 2- if the configuration is done only globally - is that VLAN automatically send tagged from the switches without a configuration needed per Switch or via local status page from the devices? 3 - the VLAN-ID which can be specified per Switch "statically" as well as per "DHCP" will be tagged or send untagged? what will happen with e.g. that configuration?   4 - the respective section in Behavior during Connection Loss to Cisco Meraki Cloud - Cisco Meraki says... If the configuration is not safe MS will try to obtain an IP address on an alternate VLAN and then connect to the cloud through that alternate connection about the keyword = "configuration is not safe" what does that mean exactly? is this procedure also happening when the switch is installed the first time with factory default configuration? ... View more

@ww wrote: Also 99% of the time local breakout doesnt work your autovpn also dont work. I don`t think so... because as in my case it`s possible to use e.g. MPLS and I think that many deployments are probably hybrid meaning Internet and MPLS as access! ... View more

will the specified "Exit"-Hub also advertise a default-route via Auto-VPN to another "normal" Hub which has the checkbox set automatically? because I´m facing the issue that the default-route is active on the spokes but not on the second hub in the network 😕 ... View more

hi @Inderdeep    yes, of course I´ve looked through the documentation, but I was`nt able to find the information I`d need... 😞 If there`s a section that would describes the answer to my question and you know it - can you please point me to that? ... View more

Hi,   it`s an "older" post but just up to date for me 🙂 please allow me two questions...   1) @GIdenJoe wrote: From the hub WAN1 to WAN1 on the spoke, WAN1 hub to WAN2 spoke, WAN2 hub to WAN1 spoke and WAN2 hub to WAN2 spoke. Do this description also applies to a deployment with a MX in 1-armed vpn concentrator mode (hub) /w two possible uplinks (MPLS + Internet) and a MX in NAT mode (branch) also with two uplinks (MPLS + Internet)?   2) @GIdenJoe wrote: So long story short:  If you have an MPLS where you overlay Meraki SD-WAN having a single breakout IP don't worry. Traffic leaving one MX onto the MPLS will be routed to the other site on that same MPLS and not crossed over to the internet unless the MPLS link on the other site is down. Does anyone know, if there is actually also an official documentation that describes the behavior @GIdenJoe explicates? ... View more

I´ve seen that in the documentation... but as @KarstenI noted, this only affects the communication - the network-prefix itself still persits in the routing-table and that`s the point I was talking about! I´d like to filter the specific network out so that e.g. a also existin summary route is the preferred one! ... View more

@Bruce I just want to let you know, that regarding the feature = Group-Policy ACL I‘ve found the following documentation: https://documentation.meraki.com/MS/Access_Control/Meraki_MS_Group_Policy_Access_Control_Lists I think it describes the functionality very good but one question is left open for me 🙂 Maybe you can tell me, how this will work/ should be configured when 802.1X Multi-Auth is configured? (example is PC connected behind IP-Phone) ... View more

that’s weired 😞 probably you know, why than the MR Firewall Configuration blocking the client from getting IP-settings from the MX via DHCP and from accessing the network as well? ... View more

what`s the difference between "Normal" vs. "Whitelist"? Unfortunatyl I can`t find a useful documentation... ... View more

so if that ACL applies to all Layer2 switchports it is used as a so called PACL - correct? Port ACLs perform access control on all traffic entering the specified Layer 2 port. PACLs can provide access control based on the Layer 3 addresses (for IP protocols)... That would make sense because the documentation states that also traffic between clients which are located in the same VLAN (infra-vlan communication) could be blocked!   What I‘m asking myself... 1) does anyone know how the usage of that function will affect the performace of the switches? 2) when using a Layer3 core switch /w SVI‘s (= acting as standard gateway) is there a possibility to only configure an ACL on the core as well and not influence the passing traffic at the access edge?     ... View more

@PhilipDAth ... regarding the ‘shared buffer‘ - do you maybe have some official documentations that you can share? I noticed that other technicians mean that there are port-buffer used!   ... View more

ok, now I understand what you mean 😎 just comparing the informations on the switches vice-versa... not the thoughts I had but of course that could work for me! 😜 ... View more

hi @PhilipDAth    yes, the plan was to buy the license to use the Adaptive Policy!   BTW - I‘ve attended the meraki PVT in the last week and the SE‘s advised that currently the way to go in using Adaptive Policy will be to work with C9K in the core! the questions - if the classic MS Series will also be adopted to use the same future proofed features like the MS390 offer today... where’nt answered very clearly to me 😕   In my case now, if the customer will decide to use micro-segmentation, I‘ll change all over to Cisco C9K switches for core/distribution and access layer! If not, than I probably choose the MS355 as the access switches because of the better stability... ... View more

hi all,   @Bruce just for my understanding I’d like to ask another question about that design approach in more detail... Let‘s assume that I use instead of the static routing a dynamic routing protocol like OSPF!     please correct me if I’m wrong - but I think that in that case OSPF won’t use ECMP because it’s only a /30 Network and the two physical links will of course not be noticed in the Routing-table on each side! But because of the use of LACP Bundling on Layer2 some sort of load-balancing will happen... here‘s now the question - will the LACP Load-Balancing Algoritm be used in that case the same way as if I use a classic traffic flow inside a Vlan located on both sides over a Layer2 Etherchannel? ... View more

hm, what can this information be used for? looking directly under the port information I only get the information what cable and QSFP is in use but no information identifying the neighbor port?!  ... View more

that’s what I‘ve tried as well, also with an explicit firewall rule - the same issue! 🙂   ... View more