See this topic, might be a 17.2.1.1 issue. OP on this fixed their issue with upgrade to 17.2.2   https://community.meraki.com/t5/Switching/Problems-with-printer-after-upgrade-MS-Switches-225-to-latest/m-p/276928#M21109 ... View more

I have to wonder if they're taking the easy route on the ticket (no offense to Meraki Support) but if its a standards based NIC then I dont see why it wouldnt work. Can you post the port config from the Aruba switch for the port it was connected to? Datasheet for the PLC would be good too ... View more

Ok adding to this, seems like when someone is connected to the AnyConnect the customer loses connection to the far end of the S2S VPN locally. AnyConnect user doesn't seem to lose connectivity to the S2S VPN at all just local LAN (Wi-Fi) users. Can see lots of logs of DNS failure on the Wi-Fi during that time, DNS server is at the far end of the S2S VPN. Anyone seen anything like this before?    ... View more

Thanks for responses. I can confirm this works, enabling the VPN Subnet under VPN Settings -> Local Networks as well as the far end adding the subnet for the site-to-site config. Had a few teething issues but its unclear if these are anything to do with this specifically or not yet. ... View more

That would then defeat the object of this being a support forum wouldn't it? The idea is we discuss these in a open topic so they can be reviewed by others in the future.  ... View more

I found this article where someone says they've got it working but never detailed how. However, most replies seem to indicate that it isnt possible. Ideally would be great to get confirmation    https://community.meraki.com/t5/Security-SD-WAN/AnyConnect-Clients-can-t-access-Non-Meraki-peer-Site-to-Site/m-p/156535#M39287 ... View more

Hey, did you test this at all? Was researching VRF's (as I saw it in the org) and was wondering if anyone had tried to implement yet of if any docs had been released ... View more

The way I read it was that you were using the MPLS but passing SD-WAN over the MPLS line, which was what lead me to my comments on MTU.   To be clear, the similar issue I was referring to, the MTU was adjusted on the network devices (in your case it would be the MX i guess) I did not alter any MTU settings on the MPLS router as this is all pre-MPLS encapsulation.  ... View more

How do you want them to communicate? IE is this a L2 broadcast discovery or will they communicate through 'known' IP addresses? I think the issue you may be having is that the ports on the MX are not switch ports so even though they're configured on the same VLAN i don't believe broadcasts will traverse the two ports.   If they will communicate over known IP's you may have more success if you segment them on different VLAN's and subnet's and create rules to allow the traffic to pass through the MX. ... View more

All the above is correct however, if you're trying to 'engineer' a way for this to work, you could look to use an RJ45 port which you could force into 100MB and then use 3rd party media convertors to convert between copper & SMF. ... View more

Here's a good doc on it and point 5 is what im referring to really https://documentation.meraki.com/General_Administration/Tools_and_Troubleshooting/Troubleshooting_MTU_Issues  ... View more

You may be missing my point. I wasn't saying it was Wi-Fi, my point is that the Wi-Fi traffic was tunneled across the MPLS. The procedure of tunneling it added additional headers to the packet that were compounded by the additional headers added during transmission over the MPLS. All this meant the packets needed to be fragmented to be transmitted and that is what caused the degradation in service. Reducing the MTU from the Wi-Fi (hence pre-MPLS transmission) kept the packet size smaller which = no fragmentation.   The reason for the comparison is that SD-WAN is essentially a VPN which is in turn a tunnel. Therefore (in my head at least) the reason it doesnt happen when just using MPLS vs using SD-WAN over MPLS could be because fragmentation is happening in the same way it did for my Wi-Fi tunneling issue. ... View more

Bringing this back to life a little as I'm interested but was also researching something similar (not with MPLS though). I was wondering if the issue was actually to do with something similar I've seen when tunneling wireless traffic over MPLS, which turned out to be an MTU issue & fragmentation. Essentially the MTU size on the Wi-Fi controller needed to be reduced to allow for the MPLS headers that get added at transmission. Without this it caused fragmentation and essentially made the network unusable. Dropping the MTU for the tunnel made all the difference. I'm not saying this is the issue just that it is worth consideration as I know SMB v2 has some options for large MTU ... View more

Appreciate that you got this sorted already but i do also believe its possible to purchase a bolt-on for reserved IP address within SC. There are some restrictions around regions but thought it was worth a mention. ... View more

Thanks Obrez, sounds similar to what I want to do but mine is for internal LAN users not VPN. I'm looking for an equivalent to the AD integration that allows group policies to be applied to users after they've logged into a domain account. Seems this isnt available with Azure AD so may have to go down the route of NAC or RADIUS auth.  ... View more