Meraki Community

jimmyt234

I would not consider this stable firmware as it does not appear under the 'Stable' release tab on the dashboard. We have also had tickets raised where Meraki support engineers refer to this as not being the stable version.

jimmyt234

Would recommend you contact support they will be able to see if you are having 'panic reboots' and RMA your device...

jimmyt234

Getting the same across multiple orgs and shards.

jimmyt234

If the VLAN requires absolutely no site-to-site traffic at all then the easier solution would to just stop advertising it to other sites by setting VPN Mode to Disabled...

jimmyt234

That's right, it only affects VPN traffic. You'd have to create Layer 3 outbound rules (on the Firewall page) if you wanted to restrict traffic to another on-site VLAN or the internet.

jimmyt234

Yes - use the site-to-site outbound firewall to create a deny policy matching the subnets. Site-to-site VPN Firewall Rule Behavior - Cisco Meraki Documentation

jimmyt234

Can you share redacted config snippets from both FortiGate and Meraki for us to review?

jimmyt234

Site-to-Site VPN Settings - Cisco Meraki Documentation You should be able to specify 0.0.0.0/0 as the remote subnet on the non-Meraki peer, there are caveats listed in the documentation above.

jimmyt234

If you are storing credentials/keys in .yml files then look into using Ansible Vault for some level of encryption of that data.

jimmyt234

The documentation on this feature states: "This feature is only supported for Auto VPN and is not intended to work with non-Meraki VPN peers." Using Site-to-site VPN Translation - Cisco Meraki Documentation

jimmyt234

As far as I am aware they act as regular networks in the sense that you set your upgrade window in the settings, they are then eligible for Meraki auto-updates and also self-service firmware updates via the portal. We used to upgrade them and keep them inline with our other security appliance network firmware levels.

jimmyt234

I will 100% forget to do that 🤣 I'd recommend you raising with support too, that way you will get case updates from them telling you when it is fixed!

jimmyt234

We have the same issue when going to the Security Center under the Organization menu, when navigating through the 'Security & SD-WAN' menu for a specific network, it appears to work. Raised with support on 15th August with a response of: "This has been confirmed as a software issue, and engineering has been notified."

jimmyt234

We have used cold swap method 1 as described in this documentation successfully many times when upgrading MX's: MX Cold Swap - Replacing an Existing MX with a Different MX - Cisco Meraki Documentation

jimmyt234

You absolutely want to go with the new hardware models at this point, the 64 & 100 will not run the latest firmware code either, so keeping it for another 5 years of virtually no updates doesn't make sense if you have the opportunity to refresh! Your current devices also are set to go end of support some time in 2027: Meraki End-of-Life (EOL) Products and Dates - Cisco Meraki Documentation

jimmyt234

Did not experienced this - have only done it on 1 vMX though...

jimmyt234

I only see 18.211.3 being the latest available patch, not .4 ??

jimmyt234

Thanks @AmyReyes and congrats to all the other winners!

jimmyt234

Yes

jimmyt234 · ‎Jul 23 2024

The device/firewall on the other end of the non-Meraki VPN needs to have your client VPN subnet configured to route down the tunnel, so it knows how to route back to you.

jimmyt234 · ‎Jul 23 2024

1) Make sure you have VPN Mode = Enabled on your Client VPN subnet on the MX 2) Make sure the remote end includes your VPN subnet in their remote encryption domain

jimmyt234 · ‎Jul 23 2024

If you want the SSID to work on the APs native VLAN then you need to remove the VLAN tag on the SSID. So set this to Disabled:

jimmyt234 · ‎Jul 18 2024

Yes! But for an OSPF enabled network it is just telling me that BGP isn't running:

jimmyt234 · ‎Jul 16 2024

You should be able to copy the link of the application from the myapps page, add this to your bookmarks toolbar and then you're only a button press away from logging in 😊

jimmyt234 · ‎Jul 16 2024

Re-IP your local network to avoid the subnet clash... or ask them politely again to review if they can do a NAT on the tunnel on their FortiGate as they should be able to, having personally done so in the past on those firewalls.

About jimmyt234

jimmyt234

Community Record

Badges