About BrandonS

BrandonS

You can buy one online here: https://merakinow.com Do you want enterprise or advanced license and for how many years?

BrandonS

Meraki actually has a nice doc that covers this exact scenario that should help. https://documentation.meraki.com/MX/Firewall_and_Traffic_Shaping/Creating_a_DMZ_with_the_MX_Security_Appliance

BrandonS

So at&t on MX #2 (spare) tested good for a week, right? It sounds like you are on the right path to isolating this, but still need to try Comcast on the MX #2? If they both show no trouble on MX #2 then I think you have your answer and Meraki should send you another. My only other thought is that while all fingers point to Meraki it could still be firmware and not hardware, but I guess you would learn that if you get that far and put both circuits on a new MX. Good luck

BrandonS

So, I would try to isolate it like I suggested. There are a few ways to approach it, but the easiest might simply be to run on one circuit or the other for long enough to observe the problem and then watch the stats and take a screenshot, make notes, etc. Then vice versa to the other circuit. If you are still seeing the spikes and experiencing problems you can probably rule out at&t and Comcast and start considering things like electrical interference or damaged fiber (maybe reroute or run new cable from MX out to your MPOE) and also it could get isolated to a Meraki issue and if you tell them all the troubleshooting you did to rule out everything else they should send you a new MX to see if that fixes it. DM me if you need cable help on site. We are licensed and insured C-7 and I have a good cable tech that lives in Oakland.

BrandonS

That does point to something in your environment or the MX perhaps. Have you worked with Meraki support yet? Maybe you can start isolating the trouble by taking one of the circuits off Meraki and monitoring each separately for a while? Does it happen often enough that you think you could catch it or reproduce the problem? And are you in Oakland, CA? I am right off the coast in Alameda 😉

BrandonS

And I should have added that then if you see packet loss and experience performance issues you can more confidently tell your ISP to fix it.

BrandonS

What IP address do you have set in configure > SD-WAN for uplink statistics? I strongly suggest not using DNS servers like 8.8.8.8, etc. because they can be anywhere and are not suited for this type of measurement. I like to put my ISP default gateway instead to measure my first hop from the MX to the ISP.

BrandonS

Isn't that :443 (and not :53) the newish Chrome secure DNS thing? I know it has been problematic for various reasons and this appears to be another.. I'll check some of my orgs to see if I am getting the same, but have not had any trouble tickets or noticed it yet.

BrandonS

Are you rebooting the upstream gear? DHCP or static IP? I suppose you tried configuring a laptop and connecting to the circuit directly? You can try paperclip reset on the MX too. From: https://documentation.meraki.com/MX/NAT_and_Port_Forwarding/Troubleshooting_Port_Forwarding_and_NAT_Rules If the MX was recently installed, or its WAN IP moved over from another device, the upstream device may still be using the MAC address of the pre-existing device. Ensure that traffic from the upstream device to the MX is being sent to the correct MAC address. This can be resolved by rebooting the upstream modem/device or forcing it to clear its ARP cache. For more information, review the article on 1:1 NAT rules not working properly after installing MX. The diagram below illustrates traffic being sent to the wrong MAC address, and thus not being translated by the MX to the LAN side.

BrandonS

I see Meraki wrote something about the topic that might be helpful too: https://documentation.meraki.com/General_Administration/Tools_and_Troubleshooting/Duplex_mismatches_affecting_physical_link_speed

BrandonS

That sounds like it could be a duplex mismatch. Try going to the local status page on the MX and login to set the port to 100-Full to see if it resolves. I suppose you ruled out the cable from the device to the MX also?

BrandonS

Meraki switches do standard LLDP voice VLAN assignment. On your switch port you want to make it an access port and then select the voice VLAN. The voice VLAN you enter is what will be announced to phones. Pair that with a DHCP server of your choice serving the DHCP options of your choice. This may help: https://documentation.meraki.com/General_Administration/Tools_and_Troubleshooting/VoIP_on_Cisco_Meraki%3A_F.A.Q._and_Troubleshooting_Tips

BrandonS

Many years ago I recall having really slow DHCP like you explain to IP phones off traditional Cisco switches sometimes. I learned before even understanding why to apply a command, spanning-tree portfast that would fix it. Here is something about it: https://community.cisco.com/t5/switching/spanning-tree-dhcp/td-p/1398109 Maybe your issue is is similar on the core switch?

BrandonS

I am a partner and there is no special situation I am aware of for non profits. “Annual renewal” is not quite accurate. Licenses can be purchased for any range from one day to 10 years and usually coterminate on the same day. Just get access to their dashboard and look at the license screen to see where they are at. Then you can budget for when they need to renew.

BrandonS

If understand correctly, you can do this. You don't put the public /29 on the LAN side though. You assign one of the usable /29 addresses on the WAN and then use 1:1 NAT to match public IP to private IP. The security risks should be quite obvious so you would want to consider only allowing access from specific IP ranges if possible. This can be set in the 1:1 NAT rules. I would also put those publicly accessible hosts in a DMZ like: https://documentation.meraki.com/MX/Firewall_and_Traffic_Shaping/Creating_a_DMZ_with_the_MX_Security_Appliance

BrandonS

I'm not sure there has been an official announcement or not. This may help: https://community.meraki.com/t5/Security-SD-WAN/vMX-License-Small-Medium-or-Large/m-p/101993/highlight/true#M25629 Small is up to 200Mbps, with up to 50 tunnels. Medium is up to 500Mbps, with up to 250 tunnels (so essentially what was the vMX100) Large is up to 1Gbps, with up to 1,000 tunnels.

BrandonS · ‎10-23-2020

I would start thinking about interference. In part, because you mentioned this happens in one building and not another. Go to wireless > monitor > RF spectrum and see how things look. A couple possibilities might be, non wifi interference or rogue devices. Rogue devices are pretty common in school environments in my experience. Someone will be unhappy with wireless performance and decide they can make it better by bringing their own repeaters and other gear into your environment. Also, portable hotspots via phone or individual devices can cause interference.

BrandonS · ‎10-21-2020

All the details you should need are here: https://meraki.cisco.com/support/#policies:return

BrandonS · ‎10-16-2020

This sounds like a geolocation mistake with your public IP. Did you try to go to a site like https://whatismyipaddress.com and see what it reports for your location? You may want to try some other sites like that too, but if you find one or more that show you in Berlin that would be the problem.

BrandonS · ‎10-13-2020

There is a little export to PDF icon on the top right of that page similar to the traditional Cisco guides.

BrandonS · ‎10-13-2020

Welcome to Meraki. It is really nothing at all like traditional Cisco. Not the gear or the documentation or support. I suppose you have been here? https://documentation.meraki.com And more specifically, here? https://documentation.meraki.com/Getting_Started Best.

BrandonS · ‎10-09-2020

Probably to MR's chose new auto channels after reboot. Can you clarify if the RF spectrum still looks similar after the reboot or did you just mean the end user problem went away?

BrandonS · ‎10-07-2020

I am far from an RF expert, but I have seen similar looking graphs when there were interfering devices. In one case I found out a wireless bridge on the roof was set to use 2.4 channel 5 (and probably very high power settings). I had them change it to a 1, 6 or 11 channel and it cleared up complaints from users on the Meraki network. Isn't there a list of interfering AP's below these graphs? I think you are looking at interference from WiFi and maybe even non WiFi devices.

BrandonS · ‎09-30-2020

What about MR45? I thought I read somewhere MR45 and MR55 both shared a "troubled" chip set or internal firmware of some sort?

BrandonS · ‎09-29-2020

Good point that the SKU may no longer exist or could change by then. Looking just at MSRP the most expensive 2 hour on site service SKU looks to be 50% the price of an MR46 as an example. Of course, there would also need to be a LIC-ENT-10YR. Depending on details of the project it could make sense to order cold spares for each location or one per n sites in a certain geographical area. Labor would still be needed, but that are national outfits that could be contracted for that. There is probably a size and price point of a project requiring 10 years of same day on site hardware with labor that this could pencil out. Conversely, it probably does not make sense for a sufficiently small project.

BrandonS

Community Record

Badges