Hello,   I am going to copy @Nash comment " Configurable count is really different from supportable. " as it makes perfect sense! While there are no hard limits, I would like you to be aware of two limits though:   1. UI supports only 256 L3 interfaces on MS switch series. 2. You can only have a maximum of 255 VLANs configured on MXs in HA. - Dashboard will not stop you from going beyond 255 but will break things if you do. This is a known bug and dev team is looking into a long term fix on this one.     ... View more

@Sarpe    That is correct! ... View more

@BK1975    In both the instances, client traffic isn't leaving its broadcast domain so no routing is involved. And that is the principal problem we are dealing with here, MX68s running 14.50 are unable to "switch" traffic between switch boards.  ... View more

Greetings everyone,   We are aware of this issue and our development team is actively working on it. The bugs states that MX68s running MX14.50 firmware don't forward traffic between switch boards.  This issue does not impact routed traffic.   I will update the thread once we have an update from our dev team.   @BK1975 Your statement " Our wireless clients could not reach anything that was plugged into the MX68 " should involve routing, and as I mentioned above - routing is not impacted. So if clients were unable to get out of their broadcast domain as well then further investigation will be required.    Best Regards, Gaurav Gupta Cisco Meraki Technical Support ... View more

Greetings everyone,   I can confirm that AutoVPN hubs should not be added to templates at all. It is not possible to configure an MX as a spoke with an exit hub that is part of a template. I will also update the AutoVPN template and deployment guides ASAP.    Cheers, Gaurav     ... View more

Hello everyone,   I have found out that we are unable to configure a node to be a spoke off a hub if the hub is bound to a template. This has been bugged to understand the expected behavior as i t is not documented within the Template nor the Auto VPN Hub deployment guides.    I will update this post once I hear back from MX development team.  Cheers, Gaurav ... View more

Hi,   Make sure that default gateway of switch's management IP is not defined as SVI of management VLAN on itself.   Cheers, Gaurav ... View more

Took a pcap on Internet interface of my MX while connecting to Client_VPN, and here's how a successful negotiation of IPsec tunnel looks like:       ... View more

Hi,   Could you take a packet capture at Internet interface of the MX (download as .pcap file for wireshark) while attempting to connect to Client VPN and filter it out using your apple computer's public IP after you have doubled checked VPN adapter settings?   https://documentation.meraki.com/MX/Client_VPN/Client_VPN_OS_Configuration#macOS   Cheers, Gaurav ... View more

Hi Geri0n, I am a bit confused. Let me tell you what I understood here - You have user machines and POS systems in a restaurant. One requirement is to allow POS systems to only reach out to a cloud server (using a specific Public IP address) and everything else should be blocked. The other requirement is to have user machines access only approved sites. Am I correct? Note: I am talking about inbound to outbound traffic (LAN-WAN) meaning flows are initiated by local devices to outside network and not the other way around. Cheers, Gaurav ... View more

If you do not have a Linux machine handy, you could simply run command "ping 1.1.1.1 -n 30" on a cmd or "ping 1.1.1.1 -c 30" on a terminal and follow the same steps mentioned above, but make sure the laptop is plugged directly into LAN port of the MX. You could still use filter "icmp.ident == ident_value" to display interesting packets only. ... View more

Hi @SlothSlayer ,   I would do the following to isolate the issue and know my troubleshooting target:   1. Connect a Linux machine directly into one of the LAN ports of the MX64. 2. Install hping3 utility on Linux machine so I am  able to mark packets in a unique way so that they can be filtered and identified. 3. Set up two simultaneous packet captures on the Dashboard - One at Internet interface and other at LAN interface of the MX with output as download .pacp file for wireshark. 4. Start both the pcaps, and quickly run command:  "hping3 -K 8 1.1.1.1 -c 30 -o 28" on Linux machine's terminal. 5. Once done, open both pcaps and compare the delta of ICMP request and response calculated from Internet interface pcap with delta calculated from LAN interface pcap. 6. If value of delta is same, MX is not at fault. If there is a noticeable difference, MX is adding latency. And If there is no difference in delta but you are seeing high delta (RTT) on internet interface of the MX, ISP is at fault.   You can use icmp identifier filter (Expand ICMP header from lower half of Wireshark screen, find and copy identifier value, and use filter "icmp.ident == ident_vlaue") on both pcaps and compare DSF value (which should be 28) to confirm that you are looking at right sequence of packets.      BR Gaurav Gupta ... View more

Hi,   I do not believe that the ability to set port descriptions was added in new "Ports" tab feature on MX. I just submitted a feature request and will encourage you to do the same using the Meraki dashboard's "make a wish" button.   BR  Gaurav Gupta ... View more

Hi everyone,   Correct, the ports tab was displaying  incorrect speed, connected status, and CDP/LLDP information on all MX platforms. Meraki Dashboard development team is aware of the issue and working towards the resolution. The "Ports" tab has been removed until all these issues have been resolved.   BR Gaurav Gupta  ... View more

Hi there,   Please keep in mind that global Layer3 and Layer7 firewall tables on MX run independently. If traffic is allowed through one feature but denied on another, the traffic will still be denied. With that being said, even if you figure out what IP, port, and protocol POS system is using to communicate with cloud server, there is no way to make it work because even if we explicitly allow that traffic under Layer 3, it is still entitled to get blocked under Layer 7 rules.   I will recommend manually whitelisting POS devices from clients list if POS systems are configured to communicate only with that cloud server. I can also help you in determining which IP MX is blocking when POS tries to communicate with cloud server, so let me know if you would like to know how to do that.   Best Regards, Gaurav Gupta       ... View more