Here is the rest of his config on the pfSense:   ... View more

I asked the engineer to send me a screenshot of his phase 2 settings, here it is:     ... View more

Never mind my ESP question...I believe this is the wire-level protocol Meraki uses by default...?  ... View more

Also, to answer the question has it ever worked, no.  ... View more

I'd like to also share initial information the remote pfSense engineer shared with me regarding how to configure phase 2, he listed the following:   ESP AES-256 SHA1 PFS on – Group 5 Lifetime 28800   Please note ESP (the first setting). Meraki does not have a field for this type of setting. I'm taking a shot in the dark here,,,could this be a cause? Would he have to select a different option for this specific setting?  ... View more

Okay, below is a screenshot of the two additional subnets participating in remote VPN (on my side of the network). I trust the remote engineer entered these on his device, along with the intended subnet that will actually do the communicating with his system (192.168.50.0/24).   Below is a screenshot of the non-Meraki VPN configuration: And finally, below is a screenshot of our IPsec policies:   ... View more

Thank you for the comment, Nash.   Yes, according to the remote engineer his system is listed with notation /32. This is also how I have his subnet entered on my end. I also have two other sites participating in VPN. I provided him those two additional subnets to configure/add on his device for the same peer, as I believe Meraki requires me to share all participating subnets, even if (let's go with your subnet example below) 192.168.50.0/24 will be the only network to communicate with this remote VPN site.  ... View more

Thought I'd share the complete details log, line-by-line:   msg: IPsec-SA expired: ESP/Tunnel 137.103.240.138[500]->72.29.24.253[500] msg: IPsec-SA expired: ESP/Tunnel 72.29.24.253[500]->137.103.240.138[500] spi=253442875(0xf1b3b3b) msg: phase2 negotiation failed. msg: failed to pre-process ph2 packet (side: 0, status 5). msg: initiate new phase 2 negotiation: 137.103.240.138[4500]<=>72.29.24.253[4500] ... View more

Thank you to everybody on this thread...your recommendations are steady. I took everyone’s advise and configured the MX to manage VLAN’s and DHCP. Very impressed with the support in this community. My network is not big by any means but I still have quite a bit of work ahead of me. I will definitely keep this community in mind for other potential roadblocks.   ... View more

Thanks, Nick...   You are correct. This will be my only physical switch. As for VLAN's, I have configured 4 thus far; 1st for our lab, 2nd for VoIP, 3rd for our office suite and the 4th for our Surveillance\DVR setup. I am planning on keeping all of my Meraki devices (router, switch & AP) on the default VLAN (1 - Lab) with static IP's assigned. Today's traffic is not so heavy, but the prediction is for volume to increase within months - hopefully : )  ... View more

Thanks, Nolan. If you don't mind me asking, why would you recommend the MX over the switch?  ... View more