Hi all,   We have a branch site that is currently set up as a spoke with a default route to our hub main site, as that spoke site needs to send certain traffic to external/public IP addresses which are only accessible via a physical WAN connection at our hub site. Ideally however, we would like to have a split tunnel, whereby traffic to the hub subnets advertised over the Auto-VPN, as well as specific external IP address ranges are sent over the VPN, and all other traffic is sent out to the internet via the spoke site's own WAN link. The aim being to reduce load on the hub site and increase speed at the spoke site when accessing IP ranges that do not require the hub site's WAN connection, whereas currently it is either all or no traffic that can be sent over the VPN.   We had resigned ourselves to this fact, however I stumbled across the following (https://documentation.meraki.com/MR/Client_Addressing_and_Bridging/MR_Teleworker_VPN), and it seems that this functionality is available on the MR devices, whereby you can specify the IP ranges & ports to send over the tunnel, with other traffic exiting from the local WAN link. However, it doesn't seem this is possible on the MX/Z series devices?   Could someone please confirm if this is the case or if there is any way to achieve what I state above? It does seem somewhat odd that this can be implemented on an access point, but not on a full security appliance.   Many thanks,   Mark ... View more

Hi,   We are having an issue with some VoIP phones in one of our offices, they periodically fail to register, we can still ping them internally but cannot make calls etc. Forcing them onto a new IP reservation then rebooting fixes this. We have run DHCP from the router, server & set them IP's statically but seemingly makes no difference.   On running a few packet captures from the MX84 on the LAN interface, I can see traffic between one of the non-functional phones and the external IP of the VoIP provider, including some outgoing only SIP packets-no responses coming back in. However, on the WAN side capture I cannot see these outgoing SIP packets (nor any incoming) for that internal IP address.   On assigning a new IP and rebooting the phone and repeating the captures, SIP packets for that phone are showing on both the WAN and LAN interfaces as expected and the phone works.   The phone provider suspects a NAT issue, we have no 1:1 or 1:Many NAT mappings set up. It seems as if the outgoing SIP packets are reaching the router and not being forwarded out over the internet, however the phone can successfully make TCP connections. Also this issue is only periodic, and affects all phones which have to be manually assigned a new IP to get them working again.   Leaving me a bit baffled as to what is causing this and why the SIP packets are not exiting the router (or at least why I cannot see them). Any help would be much appreciated on this.   Many thanks,   Mark ... View more