@Ryan_Pascoe Thanks, that makes a lot more sense.   That also means the MS390 is a beast with Meraki GP compared to a C9300 with dACL, but I guess thats the advantage of using an access-list that exists locally on the switch. ... View more

A low comment says they were able to configure this, but did not test it. ... View more

Thats great, I really appreciate you testing this. Much appreciated!! ... View more

IP-address is not copied. You can change it later. ... View more

@MRCUR wrote: @Mosquitar wrote: Hi,   Did you ever get this issue resolved? If so, what was the fix as we are experiencing issues with a topology similar to yours.   Thanks Unfortunately not. I had to reopen the support case today as the issue (likely with DNS) is still occurring and causing instability for the 425 stack. The school year ended before we were able to determine a root cause last year so hopefully it can be found this time around.  The remaining issue is being caused by malformed DNS packets through the app X-VPN - https://xvpn.io/. The individual packets are significantly larger than would be expected for a DNS response and are possibly all being sent to the MS425 CPU to process for DNS inspection.    We've put in place ACL's on the 425 stack temporarily to block all DNS traffic that does not go to or come from our internal DNS servers. MS engineering is looking into the issue.  ... View more

Great, thanks all ... View more

This is an OLD post, but I wanted to add my own experience with Disabled Switch (Bad DNS).  The Error, is just a bad Error, written poorly by Meraki Programmers.  It leaves the engineer with no real guidance as to whats wrong, not where to look.     In my Case, my customer moved their switches from DHCP to Static, When they did that, some of their switches ended up with Duplicate IPs.  The duplicated IP switches remained "online" in the dashboard, and showed "disabled Switch Bad DNS".  Even Cisco Switches in their logs show "Duplicate IP".  What can't Meraki do the same and give a clear log entry for it.  Any way if your reading this, everything everyone else is saying here is definitely worth checking, but in my case it was duplicate, IPs.  Make sure the management IPs of your gear is not duplicated anywhere. ... View more

Yes the MX can support having the same NAT on both WAN links. Here is the info on configuring it: https://documentation.meraki.com/MX/NAT_and_Port_Forwarding/Port_Forwarding_and_NAT_Rules_on_the_MX   You simply specify Uplink as Both. ... View more