In the EU we have the new RED directive which causes long delays on previous WiFi generations so ordering WiFi 7 hardware is faster. However since outdoor models (with the exception of the stadium model which costs quite a bit more) it might be a possible reason to either delay the outdoor deployment or keep with 6E. I also take into account lifecycle management and try to buy the newer stuff when possible to have a longer life on the AP's. ... View more

That one is kinda... expensive 😜 ... View more

In policy based IPsec VPN you would also need to have directly connected VPN from the spokes to the other hub and spoke to be able to reach those subnets. The whole hub and spoke thing only kinds within AutoVPN inside the same org. But you can just start VPNs from spokes to networks in the other org. ... View more

If you only route internal subnets over your SD-WAN (exit hub is NOT configured) then you will route directly from site 4 to site 1 if the destination is at site 1. If you are talking about an internet application in this first case the traffic will directly go to the internet at site 4. However if you DO configure an exit hub, then all your traffic from all your sites will be to that exit hub before going to the internet. ... View more

How are you routing from your MX105 to your Huawei cloud environment?  Do you use directly connected VLANs or do you use a transit with either static routes or BGP peering session? In case of local VLANs, just enable them for AutoVPN routing in the site to site VPN page. In case of static routes you can also just enable them. In case of BGP dynamic routing, you have to make sure your eBGP session between the MX and your Huawei next hop is in an established states and you received and set prefixes. ... View more

A Meraki AP can be connected to any kind of switch. However since the partnumber you mention is a data only switch (so no PoE switch) you will need a power injector or if your Meraki AP has a DC plug, then you'll need a DC power brick. For configuration just make sure if you use VLANs that the AP management VLAN is untagged (native) on the switch port and all needed user VLANs are tagged or allowed on the port. ... View more

That's the exception... for now 😜 ... View more

Hehe, no, all the releases are going with calendar year format. Even IOS-XE and Catalyst SD-WAN will start following this format. ... View more

Hmm, I don't believe the EOS UADP 2.0 switch will receive full cloud management support since these will at some point no longer receive updates, but of course we can't be sure. I believe changes are higher that device configuration would be possible though. I believe for full cloud management you need C9500 high performance switches (UADP 3.0 chip) or at a later time the newer Silicon one chips. ... View more

If you have 2 WAN's on each side, wouldn't that be enough to create your secondary tunnel? I know the intention of the feature is to work with 2 cloud entry points for any SASE solution but I'm just curious what would be the factor that prevents this from working. ... View more

Yes it is a bit long but that is only for the internet tests. SD-WAN fault detection is much quicker since that uses probes every second between both MX'es in an AutoVPN. I believe Ryan is referring to the SD-Internet because that is built upon SD-WAN. ... View more

Few things you must check. - If the eBGP peer is more than one hop away you'll probably need to add the route towards the next hop as a VPN static route. - On the 9500 please check the bgp advertised-routes and see if you are passing on the correct routes and make sure your ASN is not already in the advertisements so the MX would ignore them. ... View more

This is wrong. Only if the MX is running OSPF is it in an advertise only mode. When it runs eBGP with an upstream device it will learn the routes gotten from the peer and give them over iBGP to the spoke MX devices. ... View more

Are you taking into acount the time it needs to detect the failure?   When you unplug the cable on the MX side, it immediately detects link down and can use the other links. When you unplug the cable on the CPE side then the MX will not detect a link down since it is connected to the switch.  You have to wait until the ICMP, HTTP and DNS test start to fail. I will paste the following sentence of the documentation: When both the HTTP and ICMP tests have been unsuccessful for a period of time that exceeds 300 seconds, the uplink will be failed over. Therefore, it can take approximately five minutes for failover to occur in the event of a soft failure (where the physical link is still up but provides no internet access). ... View more

No I believe he is referring to the vlan profiles that also can be used for named VLANs inside the access control page of an SSID. I also fail to see what IPv6 has to do with it though. However there is an IPv6 bridging setting in network-wide -> general. There also is a bug when you use named VLANs that L2 QoS tagging is greyed out in dashboard because it thinks you are not tagging your frames. ... View more

*This* The syslogs are sent in order and will contain timestamp and hostname information. It wouldn't make sense to do this via API too.  Firewall logs (especially connection logs) zip by so fast you couldn't use that effectively.  So you really need to stream those locally. ... View more

Hey there,   1) The way spokes route will not change at all when you change your vMX.  It is also not recommended to try to move all your branch traffic over an Azure connection to the internet.  Usually you have DIA (direct internet access) at the branches or you use a SASE solution where you send nearly all your internet bound traffic for inspection.  However the routing for the Azure resources can be done directly. 2) NAT will be applied on the traffic at the WAN interface and will be NAT'ed again leaving the Azure cloud. 3) NAT does not occur when sending traffic through the VPN tunnels unless you explicitely configure it.  This is usually in cases of overlapping subnets. 4) Since a recent version it is fully supported. ... View more

You could indeed try out the new workflows feature to build a simple automation that is triggered when the primary WAN fails (webhook) that then applies a deny all rule group policy on the guest subnet and removes it when it is restored. So it would require some testing but I do see a possibilty here. ... View more

Historical views are only available for clients. As long as that client was not seen on another port it will show the client as being disconnected and on that port. So you could go to networkwide -> clients and make sure the switch and switchport column is showing and try to find that port. ... View more

You should check your DHCP page of the MX.  Per VLAN there is a mandatory DHCP setting  that if enabled will block any static IP client. ... View more

Hmm, is this some kind of SASE solution where you only want a remote web security appliance to decrypt traffic there? Since Meraki does support IPsec VPN's with SASE providers, so creating full tunnels to there and have DIA exceptions should have to be possible but I'm not sure how far they are with that. Anyone has experience with Secure access or zscaler based solutions? ... View more

AutoVPN tunnels should always come back up on their own. The only reasons they would fail if you have a NAT type unfriendly or a firewall in front (even if that firewall is an ISP doing this). Any other reason should be put into a support case. ... View more

That option does not appear on my view. ... View more

For decent roaming bridge mode is still the best. Layer 2 LAN isolation will block 2 wireless clients on the same SSID to talk to each other but this will still allow one client to talk to another if it is on the same VLAN but on a wired connection.  I'm not sure what happens if a different user is on another AP that that communication will be allowed. So my personal take would be: - Keep layer 2 LAN isolation on - Use the Access point firewall and disallow any traffic to the same subnet. ... View more

So that user does have 300+ active sessions. Does anyone know of an API endpoint to remove almost all sessions at once? Doing manually requires clicking and waiting until page refreshes... ... View more