We started using combined networks and I need to rewrite some of the automation for setting up new sites. I'm getting HTTP 400 errors when sending an array of serials for MX, MR, and MS devices while using the L_####### combined network ID. I am finding no discussions around this specifically, so I'm wondering, has anyone else run into this? Will I need to pull the MX network ID per Deep linking to the Meraki Dashboard - Meraki Developer Hub – Homepage - Cisco Meraki Developer Hub & this API endpoint: api.meraki.com/manage/organization/administered_orgs? It's possible my JSON is somehow hosed, but I've look at it multiple times over the past couple of days and I'm just not seeing what the issue would be. Hoping someone here can confirm or deny that what I'm doing should work. Thanks! ... View more

Hey everyone,   Looking for some advice here. We've got about 350 MX's using an MX600 today as a VPN concentrator (hub). It's basically there to facilitate routing and we don't have any security policies setup as that's handled via Palo Alto's. There's a relatively small amount of traffic traversing this - 50GB/day - with even less expected in the next couple of months as it will essentially turn into SNMP/syslog monitoring traffic only. The MX600 has been complete overkill for us, and I presume we could get away with an MX105. Though possible, I'm not expecting growth to surpass 500 MX's connecting in the next 3 years. We do use active-active AutoVPN with dual uplinks at all sites, but I'm not opposed to turning that back off.   From my perspective, the MX250 was released in 2017 and the MX105 in 2021, so it would make sense that the MX105 has a newer architecture and would likely be supported for a longer period of time. Does anyone have any experience with a similar scenario and relatively recently purchased devices?   Thanks! ... View more

Hello!   I figured there's a small chance someone else may encounter something similar down the line, so hopefully this is helpful!   We've got a multi-site environment with a primary and secondary data center. We have Palo Alto 3050's in place at each site that run OSPF. We also have MX600's that act as our VPN hubs for all of our 900+ spokes. The MX600's were running firmware 12.24. The MX600 at our secondary data center simply acts as a failover and we generally don't run any traffic out of it. While trying to upgrade the firmware on these MX's, I encountered an issue where the routes were not being advertised after the upgrade. Considering I had to perform the upgrade around 1AM, and we have workers coming into these remote spoke sites around 3AM, it got my heart beating. 🙂   After an hour on the phone with Meraki support, I ended up reverting the firmware in defeat.   Fast forward a couple of weeks, and I had re-upgraded the secondary site's MX to 13.28. I wanted to do some testing, so I threw an older MX on our test bench and proceeded to block all traffic from it to our primary site via the Palo. Here's the real meat of this post: When the Auto-VPN kicked in and I saw the LSA messages coming from the MX to our Palo (via packet captures), I thought "Hey, this is great!". Upon further inspection, the LSDB on the Palo did contain the two subnets from this test network, however they were not in the active routing table. "What the..." I opened a ticket with Meraki, who once again said it couldn't be an issue with the MX since it's sending the LSA packet. I was skeptical, but in the end it wasn't actually their problem directly. I opened a ticket with our Palo support and found that from firmware 12.24 to 13.28, the code must have changed so that the OSPF Link Type needed to be broadcast versus p2p. Anyone with extensive knowledge into OSPF and Palo Alto's would have known they officially say to use broadcast when the interfaces are connected via Ethernet. We just missed that little detail. 🙂   I'll be upgrading our primary environment soon and will update the Link Type in the Palo along with it. I'll report back once I verify everything is all good. ... View more