Greetings everyone,   I can confirm that AutoVPN hubs should not be added to templates at all. It is not possible to configure an MX as a spoke with an exit hub that is part of a template. I will also update the AutoVPN template and deployment guides ASAP.    Cheers, Gaurav     ... View more

Hello everyone,   I have found out that we are unable to configure a node to be a spoke off a hub if the hub is bound to a template. This has been bugged to understand the expected behavior as i t is not documented within the Template nor the Auto VPN Hub deployment guides.    I will update this post once I hear back from MX development team.  Cheers, Gaurav ... View more

Hi,   Make sure that default gateway of switch's management IP is not defined as SVI of management VLAN on itself.   Cheers, Gaurav ... View more

Took a pcap on Internet interface of my MX while connecting to Client_VPN, and here's how a successful negotiation of IPsec tunnel looks like:       ... View more

Hi,   Could you take a packet capture at Internet interface of the MX (download as .pcap file for wireshark) while attempting to connect to Client VPN and filter it out using your apple computer's public IP after you have doubled checked VPN adapter settings?   https://documentation.meraki.com/MX/Client_VPN/Client_VPN_OS_Configuration#macOS   Cheers, Gaurav ... View more

Hi Geri0n, I am a bit confused. Let me tell you what I understood here - You have user machines and POS systems in a restaurant. One requirement is to allow POS systems to only reach out to a cloud server (using a specific Public IP address) and everything else should be blocked. The other requirement is to have user machines access only approved sites. Am I correct? Note: I am talking about inbound to outbound traffic (LAN-WAN) meaning flows are initiated by local devices to outside network and not the other way around. Cheers, Gaurav ... View more

If you do not have a Linux machine handy, you could simply run command "ping 1.1.1.1 -n 30" on a cmd or "ping 1.1.1.1 -c 30" on a terminal and follow the same steps mentioned above, but make sure the laptop is plugged directly into LAN port of the MX. You could still use filter "icmp.ident == ident_value" to display interesting packets only. ... View more

Hi @SlothSlayer ,   I would do the following to isolate the issue and know my troubleshooting target:   1. Connect a Linux machine directly into one of the LAN ports of the MX64. 2. Install hping3 utility on Linux machine so I am  able to mark packets in a unique way so that they can be filtered and identified. 3. Set up two simultaneous packet captures on the Dashboard - One at Internet interface and other at LAN interface of the MX with output as download .pacp file for wireshark. 4. Start both the pcaps, and quickly run command:  "hping3 -K 8 1.1.1.1 -c 30 -o 28" on Linux machine's terminal. 5. Once done, open both pcaps and compare the delta of ICMP request and response calculated from Internet interface pcap with delta calculated from LAN interface pcap. 6. If value of delta is same, MX is not at fault. If there is a noticeable difference, MX is adding latency. And If there is no difference in delta but you are seeing high delta (RTT) on internet interface of the MX, ISP is at fault.   You can use icmp identifier filter (Expand ICMP header from lower half of Wireshark screen, find and copy identifier value, and use filter "icmp.ident == ident_vlaue") on both pcaps and compare DSF value (which should be 28) to confirm that you are looking at right sequence of packets.      BR Gaurav Gupta ... View more

Hi,   I do not believe that the ability to set port descriptions was added in new "Ports" tab feature on MX. I just submitted a feature request and will encourage you to do the same using the Meraki dashboard's "make a wish" button.   BR  Gaurav Gupta ... View more

Hi everyone,   Correct, the ports tab was displaying  incorrect speed, connected status, and CDP/LLDP information on all MX platforms. Meraki Dashboard development team is aware of the issue and working towards the resolution. The "Ports" tab has been removed until all these issues have been resolved.   BR Gaurav Gupta  ... View more

Hi there,   Please keep in mind that global Layer3 and Layer7 firewall tables on MX run independently. If traffic is allowed through one feature but denied on another, the traffic will still be denied. With that being said, even if you figure out what IP, port, and protocol POS system is using to communicate with cloud server, there is no way to make it work because even if we explicitly allow that traffic under Layer 3, it is still entitled to get blocked under Layer 7 rules.   I will recommend manually whitelisting POS devices from clients list if POS systems are configured to communicate only with that cloud server. I can also help you in determining which IP MX is blocking when POS tries to communicate with cloud server, so let me know if you would like to know how to do that.   Best Regards, Gaurav Gupta       ... View more