Yes. Packet capture was done on the wan interface  ... View more

Ah I see, that was an issue a while back but was not limited to SIP and RTP traffic but all kinds of IP traffic.  That issue was why the 18.211.0.1 was released back then.  I also had issues with that firmware build a few months ago but that was purely over the AutoVPN tunnel, not straight to the internet. ... View more

This above.  You need an SD-WAN licence, use full tunnel, and then specify excepts to get routed out the local Internet gateway. ... View more

Sorry for being this insistive although the topic already got answered - I got the Z4 box handed out by my supervisor, he claims the limits (in my case 10) are there only for non-AutoVPN and he underpins that statement by stating that he has an older model - Z3 at home on 250Mbps (I have only 50Mbps) ISP uplink and for him and his Z3, with an older model, the 80+ AutoVPN tunnels are built flawlessly (all green in the portal). My question : would you be able to support me with some official detailed documentation as I fail to find one on my own? (I keep only finding very generic datasheets where I can't find this statement that it also includes Auto VPN). Thanks! ... View more

Thanks a lot! Now it's working properly!!   Thanks!! ... View more

I change the firmware to .3 and the issue got resolve. However, I'm currently having different issue with the current firmware.  ... View more

How many users/devices are at each site? ... View more

A download is downstream, traffic comes via the ISP into your connection before any shaping so you don't have any control over the downstream path.  Upstream is a different piece since there you go from high bw to low bw. And of course you have to make sure your packets are matched and tagged with the correct DSCP value.   By default all your upstream will indeed hit the normal queue and that queue can borrow from the high queue if nothing is in it. If your circuit is direct internet access the only way to shape your downstream traffic is to have a router in front of your MX and do some random dropping inbound and shape inbound traffic to a little lower than the actual pipe of your ISP. ... View more

Thanks for the response. ... View more

These days NGFW's are essentially fully fledged routers with inspection capabilities. They're typically very flexible with how many and which ports are configured as WAN ports and LAN ports. Some are also modular to add additional ports. They're also much more likely to be able to do policy-based routing for multiple WAN interfaces, along with failover preferences and full IPv6 support. ... View more

You might find it cheaper and with greater functionality to use a Meraki Marketplace partner for this:   Cisco Meraki Marketplace | Cisco Meraki ... View more

Presumably with the Meraki native IOS version, hopefully next year 🤞 ... View more

Thank you for both your answers.   ... View more

As a minimum use opendns as your dns servers. This will already help a lot. ... View more

Thanks mate. Using this as case reference for similar issue we are facing. ... View more

You can definitely move cameras from one network to another. If it was not allowing it that would be due to no destinations networks being modern combined networks with the camera sub group type.   In that case you'd need to update your legacy combined networks to modern combined networks following the process I cover here https://docs.google.com/presentation/d/1fFjA-HCNB7KE03bUgCGINoNqVMVSumlF4Tjo-bUH9aE/edit?usp=sharing   ... View more

My apologies, I need to read better. For "Flows Deny", I am 99% certain that it's going to be an inbound connection from an external IP. We get tons of them every day. I can't give you any other information on Syslog. We let our SIEM translate it. I'm sorry. ... View more

Be aware that that C9300X-Ms have some missing features at the moment, despite the underlying hardware being more powerful.  With regard to the pricing we found them to be quite a bit cheaper than MS355Xs for the core switch, but if you need to add modules then the price is closer.  A future software rewrite is planned to fix this, but I'm surprised that they have EoLed the MS switches before it is out. ... View more

I see. We basically have 2 indoor profile first screen shot you saw was called Indoor Profile and we have another one called Classroom that has these settings up in as profile   Would this need to be changed ?   Also down below is SSID config setup for our Student wifi  ... View more

Did you add vlan 20 on the trunk between mx and core switch? -The trunk link between the Core switch (Catalyst-M) C9300X-12Y is tagged on Management Vlan 5 with allowed VLANs 1-1000   Did you remove the static route for vlan20 from the mx to the coreswitch? Yes, this was a pre-requisite otherwise I was not able to add the Subnet onto the MX   Did you remove the vlan 20 svi from the switch? Yes, I removed this.   Core switch has one route on it 0.0.0.0/0 next hop of the MXs transit IP address.     ... View more

I should be under network- wide > general   Or org> settings >snmp   https://documentation.meraki.com/General_Administration/Monitoring_and_Reporting/Meraki_Device_Reporting_-_Syslog%2C_SNMP%2C_and_API#SNMP_Configuration   https://documentation.meraki.com/General_Administration/Monitoring_and_Reporting/SNMP_Overview_and_Configuration#Configuration ... View more

Thank you very much! ... View more

You can have sticky flows with gracefull failover. You could do a packet capture on that port to see what traffic is still active https://documentation.meraki.com/MX/Firewall_and_Traffic_Shaping/Connection_Monitoring_for_WAN_Failover   "Existing flows will remain on the backup path until expiry" ... View more