Appliance updated to 16.9 and now end users are getting certificate is not secure issues and only way to work is selecting allow untrusted servers which is not really viable.  Tried rolling back to previous version and still getting the error. GA for MX95 is 16x and per all documentation on AnyConnect it will no longer be beta when 16x is GA so I don't really have any options that I know of.  Any thoughts on what can be done to dix? ... View more

Having a weird issue where clients connecting to the SSID will randomly be switched to an access point on the other side of the building with drops the service.  SSID is on the same VLAN and is configured to bridge mode and has band steering on and both access points have less than 10 clients connecting to them.  Any thoughts on what could be causing this? Thank you ... View more

We are having an issue where we had to replace an ASA5505 and before there was a site to site vpn and now with the current MX64 the connection is not working.  Here was the config from the ASA for the VPN:   name 1.2.3.4 Diag description Diag VPN   access-list outside_1_cryptomap extended permit ip host 10.0.20.45 Diag 255.255.255.248 access-list inside_nat_static extended permit ip host LocalServer Diag 255.255.255.248 static (inside,outside) 10.0.20.45 access-list inside_nat_static   crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac crypto ipsec security-association lifetime seconds 28800 crypto ipsec security-association lifetime kilobytes 4608000 crypto map outside_map 1 match address outside_1_cryptomap crypto map outside_map 1 set peer 4.5.6.7 crypto map outside_map 1 set transform-set ESP-3DES-SHA crypto map outside_map 1 set security-association lifetime seconds 14400 crypto map outside_map 1 set security-association lifetime kilobytes 10000 crypto map outside_map interface outside crypto isakmp enable inside crypto isakmp enable outside crypto isakmp policy 10 authentication pre-share encryption 3des hash sha group 2 lifetime 86400   tunnel-group 4.5.6.7 type ipsec-l2l tunnel-group 4.5.6.7 ipsec-attributes pre-shared-key xxxxx peer-id-validate nocheck isakmp keepalive disable     Current Meraki Connection is set to Public IP 4.5.6.7 Private Subnet 10.0.20.45/29 IP SEC Policy PH1 - 3DES / SHA1 / DH2  / Timeout 14400 PH2 - 3DES / SHA1 / PFS off / Timeout 14400   Event log shows   Non-Meraki / Client VPN negotiation msg: failed to pre-process ph2 packet (side: 1, status: 1). Non-Meraki / Client VPN negotiation msg: failed to get sainfo. Non-Meraki / Client VPN negotiation msg: initiate new phase 2 negotiation: Local_PublicIP[500]<=>4.5.6.7[500] Non-Meraki / Client VPN negotiation msg: IPsec-SA expired: ESP/Tunnel 4.5.6.7[500]->Local_PublicIP[500] spi=178891342(0xaa9acb0) Non-Meraki / Client VPN negotiation msg: failed to pre-process ph2 packet (side: 1, status: 1). Non-Meraki / Client VPN negotiation msg: failed to get sainfo. Non-Meraki / Client VPN negotiation msg: ISAKMP-SA established Local_PublicIP[500]-4.5.6.7[500] spi:5407379688442cfd:315d9f4a0c478522 Non-Meraki / Client VPN negotiation msg: initiate new phase 2 negotiation: Local_PublicIP[500]<=>4.5.6.7[500] VPN registry connectivity change vpn_type: site-to-site, connectivity: true Non-Meraki / Client VPN negotiation msg: failed to pre-process ph2 packet (side: 1, status: 1). Non-Meraki / Client VPN negotiation msg: failed to get sainfo. Non-Meraki / Client VPN negotiation msg: IPsec-SA expired: ESP/Tunnel 4.5.6.7[500]->Local_PublicIP[500] spi=108337968(0x6751b30) Non-Meraki / Client VPN negotiation msg: pfkey DELETE failed: No such process Non-Meraki / Client VPN negotiation msg: ISAKMP-SA deleted Local_PublicIP[500]-4.5.6.7[500] spi:74f722074d7dc223:2e10212799bd830f Non-Meraki / Client VPN negotiation msg: purged ISAKMP-SA spi=74f722074d7dc223:2e10212799bd830f. Non-Meraki / Client VPN negotiation msg: purged IPsec-SA spi=0. Non-Meraki / Client VPN negotiation msg: Unknown IPsec-SA spi=0, hmmmm? Non-Meraki / Client VPN negotiation msg: purging ISAKMP-SA spi=74f722074d7dc223:2e10212799bd830f.     Any thoughts?  Thank you ... View more

We originally saw speed issues utilizing the MX67W where the throughput on a 100MB connection was at best 5MB/s.  This is what we have tried so far:   1. We are on our fourth meraki mx67w that support keeps sending us and still have the issues 2. I have put a new cable modem in and still have the issues 3. I have disabled the wireless and still have the same issues 4. Replaced all network cables and tried with no devices connected and portal still shows 5mb/s 5. Plugging meraki mx into home network I get full connection speed   If we plug in another router (netgear) we get the full 100mb connection.  Meraki support has no clue and wondering if anyone else is experiencing similar issues or has any other suggestions. ... View more

We have a layer 7 filter to deny traffic to/from all countries except: Canada, France, Germany, Ireland, Netherlands, Sweden, Switzerland, UK, USA   For some reason this is blocking the ability to goto office.com, we are able to go to other microsoft sites but was wondering if anyone knew what countries we should allow for traffic to flow?  I have tried to whitelist the url as well as turning off AMP with no luck. ... View more