Swapped out the MS220 for a MS350 and it works kinda sorta.  MXA is up with the assigned address in the /29 but MXB says "not connected" even though I can see pings to it's assigned WAN interface on the pcap - it just doesn't respond. ... View more

(And max 16 static routes.)   The challenge with meraki switches is that it needs the management ip in the vlan of the default route. Or at least the gateway of the management ip cant be a svi itself. (Im not sure if the dashboard forces you to do this) in that case the /30 is not big enough   But that is with every model https://documentation.meraki.com/MS/Layer_3_Switching/MS_Layer_3_Switching_and_Routing#Layer_3_Interface_Caveats ... View more

Ok, I should probably clarify, this is already in place (the connection) the current firewall is a watchguard, but they are using the /30 address.  We will be putting in the MX. Was trying to see how to configure it ... View more

I have the same problem here. I am still investigating. It seems that in the dashboard for the Meraki vMX the non-Meraki can be configured, but that the settings at the system level (Azure VM) are not accepted. After all, it is a fully secure and closed VM image ... View more

Same issue here. DNS is going to the router-assigned DNS servers, not the VPN-assigned servers. Specific example, with confidential info replaced:   C:\Users\*****>ipconfig /all Windows IP Configuration Host Name . . . . . . . . . . . . : ***** Primary Dns Suffix . . . . . . . : Node Type . . . . . . . . . . . . : Hybrid IP Routing Enabled. . . . . . . . : No WINS Proxy Enabled. . . . . . . . : No DNS Suffix Search List. . . . . . : lan Ethernet adapter Ethernet: Connection-specific DNS Suffix . : lan Description . . . . . . . . . . . : Intel(R) Ethernet Connection (7) I219-LM Physical Address. . . . . . . . . : <MAC address> DHCP Enabled. . . . . . . . . . . : Yes Autoconfiguration Enabled . . . . : Yes Link-local IPv6 Address . . . . . : fe80::3c38:d255:d9cb:8968%17(Preferred) IPv4 Address. . . . . . . . . . . : 192.168.86.41(Preferred) Subnet Mask . . . . . . . . . . . : 255.255.255.0 Lease Obtained. . . . . . . . . . : Monday, October 4, 2021 6:39:38 PM Lease Expires . . . . . . . . . . : Thursday, October 7, 2021 3:45:10 AM Default Gateway . . . . . . . . . : 192.168.86.1 DHCP Server . . . . . . . . . . . : 192.168.86.1 DHCPv6 IAID . . . . . . . . . . . : 115627240 DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-25-6F-DB-E4-E4-54-E8-74-6F-FD DNS Servers . . . . . . . . . . . : 192.168.86.1 NetBIOS over Tcpip. . . . . . . . : Enabled PPP adapter <The VPN connection name>: Connection-specific DNS Suffix . : Description . . . . . . . . . . . : <The VPN connection name> Physical Address. . . . . . . . . : DHCP Enabled. . . . . . . . . . . : No Autoconfiguration Enabled . . . . : Yes IPv4 Address. . . . . . . . . . . : <DHCP address assigned by the MX100>(Preferred) Subnet Mask . . . . . . . . . . . : 255.255.255.255 Default Gateway . . . . . . . . . : DNS Servers . . . . . . . . . . . : <Internal DNS server 1> <Internal DNS server 2> NetBIOS over Tcpip. . . . . . . . : Enabled C:\Users\*****>nslookup <website>.com Server: UnKnown Address: 192.168.86.1 Non-authoritative answer: Name: <website>.com Address: <public address> C:\Users\*****>ping <Internal DNS server 1> Pinging <Internal DNS server 1> with 32 bytes of data: Reply from <Internal DNS server 1>: bytes=32 time=4ms TTL=125 Reply from <Internal DNS server 1>: bytes=32 time=3ms TTL=125 Reply from <Internal DNS server 1>: bytes=32 time=16ms TTL=125 Reply from <Internal DNS server 1>: bytes=32 time=4ms TTL=125 Ping statistics for <Internal DNS server 1>: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 3ms, Maximum = 16ms, Average = 6ms ... View more

@leadtheway : yes you can still do that redundancy. Let suppose x amount of traffic is passing through wan1 and y amount of traffic via wan 2, if wan 1 link down, the x amount of traffic failover to wan2 with y amount of traffic, similar vice versa. ... View more

Lol , sorry for making you guys read that..I got it worked out.. I had planned on posting a diagram later after i posted but I was in the weeds. Thanks anyways! ... View more

https://meraki.cisco.com/blog/2016/05/visio-stencils-now-available/ ... View more

If the LAN subnet is working fine, that sounds like you need to poke your vendor some more about setting your client VPN subnet up "just like my LAN subnet." 😕 ... View more

I would adopt a different approach.   Put an MX at HQ in VPN concentrator mode behind the ASA.  Terminate your MX spokes onto this using AutoVPN.  Then just use simple static routing between the ASA and the MX at HQ.   Your life will be much simpler if you do this. ... View more

i can see ACls and crypto map in the asa with a source of the asa subnets and destination of the MX subnets with ip service set to permit. ... View more

I know this is closed but with the 15.x firmware this now can be done through the web GUI.  Tested in 15.14 and 15.15 ... View more

Hello!   What is the difference between setting the route here under Security & SD-WAN > Site-to-site VPN > Local Networks to YES under 'Use VPN' and ticking the box 'In VPN' from creating a static route under Addressing & VLANs?    https://documentation.meraki.com/MX/Networks_and_Routing/MX_Addressing_and_VLANs   In VPN: Determines whether the MX advertises this static route to site-to-site VPN peers. Thank you! ... View more

If you are denying local lan access on the wireless firewall settings, it will block. However you are correct, for devices plugged in hardwire on that VLAN, you would want to edit the MX firewall settings to block inter-vlan communication.   For example:   You could also do some ACL on the switch side if you have SVI's on your core switch etc. ... View more

did not get it to work ... View more

Perfect, thanks! ... View more

No need to delete it. It might help someone else down the line. You can mark an answer as the solution, perhaps @PhilipDAth 's second post: https://community.meraki.com/t5/Community-Tips-Tricks/About-Solutions/td-p/21066 ... View more

yeah i have a print server i could ping.  That worked...so def. a windows firewall/SEP issue.. thanks for the help ... View more

What is the device in question that you are using if I may ask? Start with only allowing 11Mbps first, see if it connects. If not then go down to 5.5, see if it connects. If not then go to 2 and see if it connects. If you can get it to connect a higher data rates (5 or 11 etc) the better. Otherwise there is a good amount of overhead SSID wise when you enable DSSS-only rates (1 or 2Mbps) ... View more

please remove...the issue wasn't my config, it was the wrong subnet was given to me ... View more

so simple, thanks! ... View more

Doesn't really matter, both will work. But of course there are nuances. If you hook it up to the MS then it becomes an an extra point of failure, the MX can go down and the MS can go down, but you don't have to use an extra MX port.   In a real highly available (and larger deployments) design you'd have two MXs (one in Warm spare), then two L3 switches in VRRP (likely fiber switches like the MS410 or up) and then have all your access stack double uplinked to that duo of L3 switches.   Also, in your current design the routing is done by the MX. In larger deployments, if a lot of inter-VLAN traffic is expected sometimes an extra L3 layer is better. In that case the central MS would actually become router instead of the MX. But then you need the DHCP relay thing and a static route for the VLANs you're going to route on the MS. But I don't want to overcomplicate your setup... ... View more