I tried all possible options long time ago, and I got Cisco ASA specialist and Meraki "working" in a case during 6 months, we made some little improvements thanks to the Cisco Engineer who was the only one with enough knowledge there, we finally gave up and removed the MX to get back to ASA to ASA. good luck ... View more

I also configured exactly the same threshold and retry values, we already gave up on this and our tunnel just keep failing after more than 1 year and a half, we engaged Cisco ASA engineers (positive experience as usual) and Meraki (really need to improve) and the issue was never found. All the best for your case.  ... View more

make sure you are not running PVST in the current switches as it is not supported by Meraki and you could run into interoperability issues.  ... View more

I have been struggling with a similar case for 1 year, Meraki Support doesn't even respond anymore 🙂    https://community.meraki.com/t5/Security-SD-WAN/VPN-stops-passing-traffic-between-Meraki-Security-Appliances-and/m-p/27624#M6658   running Cisco ASA 9.1 and 9.4 without success, MX failing from 12.x running latest 14.30 now as suggested by them with the same result. Configs on both sides were checked by a ASA and Meraki Engineer, all good but it keeps randomly failing, only solution is resetting tunnel manually from the ASA, running a script now to solve that...   good luck! ... View more

I completely understand your frustration and I share your pain. I have been 1 year struggling with a support ticket and in the end we will need to remove the few devices we had in production (more than 60 people actually) and come back to ASA and catalyst.    We already purchased many switches (250, 425, and the MX600 in production...) and we couldn't install most of them because we got issues in all of our tunnels towards ASA, after involving Cisco ASA engineers and multiple Meraki engineers we couldn't solve it.    The ticket has passed through 8-10 different engineers, repeating the same over and over, talking to managers who seemed to understand my frustration but the situation always ended up on the same point, they assign a "specific" engineer, then we do the same tests, and we run again out of ideas.    I understand the solution is working for many other people, or I want to believe so, but from my experience, some features are just not ready to interact with 3rd parties, even if this 3rd party is Cisco.    KPI or SLA doesn't seem to exist in Meraki Support (having a ticket opened for 1 year and no further escalation or managers aware asking for it??).           ... View more

regarding this bug CSCso70269 we were running 9.1 and now 9.4.4 as the Cisco engineer told us we could be hitting other bugs too, and the bug is on version 8.x. But now on 9.4.4 we had another issue too.    if NAT-T is an issue someone should had raised it to me after 1 year struggling with this ticket and I don't know how many engineers we have had already (if I say 10 different engineers I am not lying). ... View more

I completely agree with you and I share your pain.  ... View more

almost 1 year now with this ongoing issue, having to manually reset the tunnel every now and then, many conversations with Cisco and Meraki engineers, upgraded ASA to 9.4.4 as supposedly was a buggy behavior on Cisco, and nothing, still the same. I am sorry but this is the worst technical experience I have had so far in more than 12 years. ... View more

I am still struggling with an issue between Meraki MX and ASA since last October 🙂 Cisco and Meraki are engaged and although we keep trying things the root cause has not been found, we have performed live sessions and troubleshooting.   last thing was that Meraki was changing the WAN IP randomly between the firewall physical interface and the VIP, breaking up tunnels randomly too, we were on 13.28 and they recommended upgrade to 14.30 (Beta), we just found that the issue persists so we are really running out of ideas and it is very frustrating.    good luck! ... View more

I am just curious is bpdu filter working for you between two switches? you are still receiving BPDUs, I don't think this would be recommended?  ... View more

what STP version is your catalyst running? if it is PVST then you need to change it to MST, otherwise you will face long recalculation times every time there's a link down there.  ... View more

Completely agree, I am a big Cisco fan, what Meraki is doing with its support is definitely not good for Cisco. My ticket is opened since last end of October,  "escalated" through different ways, reseller, trying to make them escalate, etc. only last week a manager called me apologizing for how the case has been handled! there's no a good follow up, there is for simple small cases yes, but not for complex issues. I have talked to many engineers, some of them didn't even bother to register what they did, I can't understand why. I tried to escalate through the support center and I only got excuses or just ignoring the request. ... View more

a network device shouldn't be allowing the same segment in two different interfaces right, is that true that the MX allow it?  ... View more

yeah and in London he seems to be always in meetings 🙂    the problem is that they don't even talk between engineers, we have to repeat the same things over and over. They have taken several captures, they keep asking for the same, it means that they are not probably uploading any information.  ... View more

But what about individual tickets, I mean, if a customer is telling you the service is breaking every now and then, and this is stopping a bigger deployment, I would assume there's someone there taking care of these escalations and assigning the proper engineer as well as following up closely this ticket. a ticket opened 8 months ago without a proper escalation process doesn't say much about this company, I could expect this support level from a start-up not from Cisco Meraki. ... View more

I have a case opened from last October (yes, last October) with no progress at all, the ticket is being passed from one engineer to another, repeating the same basic steps every time. I have escalated to the Cisco Engineer because it is VPN integration issue with an ASA, even the Cisco engineer is showing his frustration at this point because of the lack of response from Meraki support.    I have tried to get escalation multiple times, even saying that I will return the product back, but I still feel there's no a real sense of how critical the issue is for us right now, while the ASA engineer responds within the next hours with a very detailed progress or questions the Meraki engineer keeps giving us some basic checks and pointing to a KB, which we have checked thousand of times.    To be honest, this is very frustrating and disappointing, nobody in Meraki is looking at these SLAs/KPIs?!  ... View more

are you NATting in the firewall? I have everything behind NAT, so I wouldn't understand the point of disabling NAT-T as I need to encapsulate in UDP to work with PAT 😕 ... View more

from the logs,  I can see this when failing from the ASA:   where x.x.x.x is the Meraki remote public IP.    [IKEv1]Group = x.x.x.x, IP = x.x.x.x, QM FSM error (P2 struct &0x00007ffe60d39e40, mess id 0xb107883c)!  [IKEv1]Group = x.x.x.x, IP = x.x.x.x., Removing peer from correlator table failed, no match!  [IKEv1]Group = x.x.x.x, IP = x.x.x.x, Session is being torn down. Reason: Phase 2 Mismatch   Also, from the debugging, it looks like there's a crypto ACL mismatch, but the ACL that shows the log is actually properly configured in both sides, mirrored. Again, when clearing the tunnel everything starts working fine again.    Cisco pointing to Meraki, but no answer from them.      ... View more

maybe it is related to the anti-replay window size as per above comments, if that's the fix what it would be shocking to me is the fact that I have had my ticket open for months and no engineer has been able to provide any information, and that the 'fix' actually comes so late. In any case, the damage is made.  ... View more

yeah, Phase 1 remains up, but no SPI are built in the remote end, only resetting the ipsec or bouncing the tunnel works.   I am trying to collect some debugging from the ASA to see if Cisco can helps here.      ... View more

marking the case as High priority won't make any different from my experience.    I had my firewall running few months ago on 12.x and they asked me to move it to 13.28, same result.    behavior is like you describe. I have escalated this issue to Cisco ASA engineer, I will keep you posted but I would recommend you to do the same as Meraki is not helping at all on this issue, it is very frustrating (they keep passing the ticket among engineers and I have to explain the same story every time, without any progress).   regards. ... View more

What happen if your access switches are still downloading the new image and your distribution switches reboot? or the system is intelligent enough not to break the upload process?    I saw the Staged upgrades, but I can't do it by myself, according to Support I have to make them a call and they will be the one activating the functionality and the process.    Specifically for a 4 stack access that I have, with 2 uplinks to the distribution, they said that issues may happens and they are recommending me to schedule at least a 1 hour downtime per stack. That's a lot actually... for a critical business running 24 hours that's not easy to assume.      ... View more

What happen if we don't want to go for the latest release? I mean, we all know it is a pain to get a proper window when we have 24 hour users and it is business critical, with Cisco we just leave a release running for more than 1 year without issues, even years if we don't need any new feature.  ... View more