Meraki

ww

That would only work in you start using bgp in the non meraki tunnel https://documentation.meraki.com/MX/Site-to-site_VPN/BGP_routing_over_IPsec_VPN https://community.meraki.com/t5/Security-SD-WAN/routing-from-remote-network-across-non-Meraki-VPN-Peer/m-p/263556#M58339

ww

You can also look into using a group policy and apply that to the vlan https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Creating_and_Applying_Group_Policies

ww

You could try enabling this between the vlans. https://documentation.meraki.com/MX/Other_Topics/Configuring_Bonjour_forwarding_for_the_MX_Security_Appliance

ww

Need him to fix MX-34504

ww

https://docs.sse.cisco.com/sse-user-guide/docs/manual-meraki-mx#caveats-considerations

ww

Could be firewall settings. Do you have layer3 firewall rules on the mx? Are you using meraki wifi? https://documentation.meraki.com/MR/Firewall_and_Traffic_Shaping/'Deny_Local_LAN'_settings_in_Cisco_Meraki_MR_firewall

ww

You dont need to change the config or rule. You can just make the capture (on mx lan or client device) and run the powershell script (or even better from a real client device ). Its just to verify the powershell script using unencryted udp for dns lookup. Ofc also create a case, they can assist you way better looking into device and config

ww

Could you make a packet capture on the mx lan. And then run that script. Look if the host does a udp dns request

ww

On most Regulatory Domains the higher channels allow higher transmit power. For example: https://documentation.meraki.com/MR/Radio_Settings/EU_Compliance_Information

ww

Mx95 has better performance, and support new firmware. so its a good replacement. You can't do HA between 100 and 95, so they need to replace both (not sure if they do that.. ask support) Support needs to convert the license from mx100 to 95 https://documentation.meraki.com/General_Administration/Licensing/Meraki_Co-Termination_Licensing_Overview#License_Conversion

ww

Lets hope it doesnt trigger ids bug. @Hannah-C @Port range "1024-400" should be 4000?

ww · ‎Apr 11 2025

try to set the static route of that anyconnect subnet to the mx ip (on your udm pro) To add a static route, go to Settings -> Advanced Features -> Advanced Gateway Settings -> Static Routes

ww · ‎Apr 11 2025

Does your router/fw routes the vpn/anycon subnet back to the mx67 ip?

ww · ‎Apr 8 2025

Yes i have the same issue for a few hours now

ww · ‎Apr 8 2025

It should be possible with sdwan+ license. Without sdwan+ you can only steer traffic based on destination subnets https://documentation.meraki.com/Architectures_and_Best_Practices/Cisco_Meraki_Best_Practice_Design/Best_Practice_Design_-_MX_Security_and_SD-WAN/SD-WAN_Internet_Policies_(SD-Internet)

ww · ‎Apr 8 2025

It more a informational notification. https://documentation.meraki.com/MX/Networks_and_Routing/MX_Routing_Behavior#Overlapping_Routes The router will first use routes to 10.238.70.0/24, 10.238.71.0/24, 10.238.76.0/23, and 10.238.78.0/24 All other 10.x.x.x destinations wil be routed to the new tunnel

ww · ‎Apr 8 2025

No, all adv lic supported models must all run adv lic or ent lic https://documentation.meraki.com/MS/MS_Overview_and_Specifications/MS130_Datasheet#Licensing If the organization has existing MS390/C9300/MS150s with advanced licenses, they cannot add MS130's with enterprise licenses in that organization - they must be added with advanced licenses.

ww · ‎Apr 7 2025

No, traffic probably won't even hit the mx vlan

ww · ‎Apr 1 2025

https://documentation.meraki.com/General_Administration/Inventory_and_Devices/How_to_Locate_your_Meraki_Order_Number

ww · ‎Mar 31 2025

10gbps is more then the max 1 gbps of the sfp. The ones i checked are showing 1Gbps (sfp slot) You are not looking at a mx95?

ww · ‎Mar 31 2025

Single iperf stream could be limited because of tcp latency Did you try with more streams? -P 5

ww · ‎Mar 27 2025

I would like that they support certain major fw for longer time. At some point 17 was good for us. But then you get forced into 18.x because some models dont get patches on 17.x.

ww · ‎Mar 25 2025

If your spoke has DC-B as first hub. The DC-A HUB would do as Prepend 2x the AS number. HQ would choose DC-B as preferred (shorter) return path. You want force all traffic to DC-A for a reason from the HQ? And why not set spoke to prefer DC-A?

ww · ‎Mar 20 2025

The closest you get would be making one of that locations also a hub. And connect the one spoke location also to that (new) 2nd hub. Then the spoke would connect directly to the advertised vlans on that 2nd hub

ww · ‎Mar 18 2025

You need more public ip's Or the router have to run nat, and provide you with 2 ports and private ip space Or you have to place another nat router in between. You could also wonder if you need ha if all other parts a SPoF

About ww

ww

Community Record

Badges