Does the gateway have the new subnet mask of 255.255.254.0, or is it still on 255.255.255.0? ... View more

Or use a dedicated MX (any router) on the second link to create multiple IPs on its LAN side (the MX HA pair's WAN side) ... View more

The only certified part I am aware of is the MA-SFP-1GB-TX but a Cisco GLC-T works just fine...  There are no 10GbE Cu certified parts ... View more

On the second WAN if you have enough IP addresses, configure as a virtual and if possible do the initial setup where you have both connections and then move the warm spare to the new location.  We had no trouble with warm spares having one WAN down for several weeks while we got everything set up. ... View more

Do I need to put a public IP on the spare MX - configured locally, and then add that in IP in via dashboard?   Configure IP before plugging in, also use virtual IP as you should have enough to share one between the MX pair. I can't find a way to put an inside IP on the spare MX250 via the local dashboard? Does VRRP handle the LAN side? Meaning I don't add an IP on the LAN interface of the spare MX250 at all?   The LAN interface shares the IP, it uses VRRP so you don't need to add an IP here.  Note if connecting to a switch stack or hsrp/vrrp pair, you should have one link from each MX to each switch. Should I leave the LAN interface shutdown until it's added in via the Configure warm spare button? (like willette suggests)   Configure warm spare should be done before connecting the warm spare MX but ideally after upgrading it to the same firmware.  You can do this by adding it to a test network first, then removing that network and adding as warm-spare ... View more

OSPF only has limited support, it only advertises, it doesn't listen.  There is no EIGRP support.   ... View more

It is flagged, I'll chase! ... View more

You can have a total of 512 unique /27 networks in a /18 subnet.  Therefore a simple count should let you know how many you have left, unless some overlap... ... View more

We use 26.6.1 across 100+ APs at all our sites and it is better than 25.13.  However, the oldest AP model we have in production is the MR32.  For you with MR18s I'd go with 25.13 first as the 25 release train definitely supports the MR18 model. ... View more

Okay, as it seems to be either down to the APs, or the wireless drivers on the laptops, I'd check to see if they have been recently upgraded first, due to you having not done a wireless AP software upgrade for a while.  If they have had an upgrade then downgrade one to check.  If not, and as a best practice anyway, upgrade the APs to the current stable 25.13 or the stable release candidate 26.6.1.  Before you do that please reply with the AP model(s) you have, as this might influence which of those to choose. ... View more

We did test it when setting up but I'll test one of our setups again as I'm sure that wasn't the original result...  I'll reply on here either way, though I wonder if it is related to us playing with no NAT mode on the routed HA pairs? @Ben83 in the meantime, use the method @GIdenJoe suggested as that matches the documentation and known to work.  Our method (carried over from when we had pairs of Cisco IOS routers in HSRP pairs) may not be correct and we have just been lucky that we haven't experienced the dual master scenario in the six months we have been running the HA pairs of MXs 😟 ... View more

However as the vrrp covers failover when you have only one link from each MX to the stack, I prefer this as it doesn't rely on STP blocking.  It may not be textbook, but it does work! ... View more

Oops, forgot that, post edited to remove confusion.  I knew there was a reason we just had one link to each HA MX from our stacks... ... View more

-- edited to remove wrong information -- ... View more

The VPN connection gives you layer3 (IP) access to internal subnets.  This is why IP connectivity works but mac (layer 2) connectivity will not. ... View more

If you have a spare port on the firewall, you could set it up with the IP of the DDOSer as that should stop your WAN interface responding to packets from that IP.  Just an idea and not sure how successful it might be as the route to you would probably still be saturated... ... View more

You'd be better using something like TeamViewer to connect to a device left at home on the Sonos VLAN.  VPN users have to be on a separate L2 domain to the internal networks so I don't think VPN is an option.   Mind you, if your Sonos devices are more than a couple of years old you won't need to worry about updates soon... 😉 ... View more

The latest 15.23 is apparently the last of the releases to be tagged as early release beta.  Having said that we run our whole estate of MXs (~25) on 15.x and have done since at least 15.14 if not before.   We have found it entirely stable and needed it for some of the multiple link SD-WAN features. ... View more

Crossed over? ... View more

@Dilevone of the first things I learnt in networking is just because you have set something up to behave in a certain way, never assume that it is!  All too often I have found that a firewall allow all policy is still inspecting traffic and dropping some...  Of course this may not be the issue for you, but always worth verifying.  Also you are running a somewhat old version of the AP software, but I wouldn't upgrade until you have done the wired test. ... View more

In concentrator mode you only use the first WAN port, all traffic goes through this interface and back out of it.  So the MX sits as a spur off the LAN (but using it's WAN port) which for the 250 is the SFP+ socket. ... View more

We have an MX HA pair at each site and a stack of physical switches that they connect to.  We cable one MX to one switch and the other MX to one of the other switches.  Therefore if either MX fails you still have a connection to the switch stack.  Equally if the switch connected to the active MX fails, the other MX takes over and as it is linked to a remaining working switch, you still have a connection.  Worst case where you get a partial failure on a switch, as the MXs are connected to the dashboard via the WAN ports, you can force a failover. ... View more

@IotaNetworks I'm not sure how you'd set up an Auto VPN hub in pass-through mode.  It needs to be able to route for auto VPN to work.  We have the MX hubs in our main DC set up as concentrators and this works very well.  It also removes the restriction of two WANs as you can route as many as you like to the concentrator using L3 switches between the site edge and the MX.  I'd follow that route and use the information in the post from @BrechtSchamp to learn how to make the most of it. ... View more