Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Register or Sign in
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
About mackem
Community Record
9
Posts
1
Kudos
0
Solutions
Badges
Apr 27 2020
10:04 AM
There is no way a telephone line to leased line has better connectivity than leased line to leased line. The stats on the MX confirm that. I rebooted the MX which cleared the erroneous 100% loss rate the MX was reporting on WAN1 however it still overrides the manual policy that is meant to send everything down WAN1 and sends stuff down both. Loss/latency/jitter stats are much better on WAN1. Just knocked off the active-active auto-VPN which broke connectivity to from this MX to one of our other sites. So it seems that autoVPN will not form over this particular interface therefore will only send it over WAN2. I'm at a loss, will be logging with Meraki
... View more
Apr 24 2020
7:03 AM
So i configured a policy (any to any) to only use WAN 1 unless it needs to failover and that seems to have made no difference In VPN status its still sending traffic down both WAN links. Under "Reason" for sending down WAN 2 it has "Performance based" which makes no sense as WAN 1 is the better performing link. This is happening even though its matching against the policy "Prefer WAN 1". While i was looking at the VPN status page the VPN registry went from green to yellow, saying it can connect to at least one VPN registry...hmmm Drilling down on the performance stats it is monitoring for each uplink, it seems to think that Loss is at 100% for Uplink 1 which makes no sense as the link is operational. And yet, if you go to Appliance Status > Uplink and look at the Live stats.....whatya know, there is no loss on the WAN1 at all Makes no sense to me
... View more
Apr 24 2020
12:31 AM
Hi SD-WAN & traffic shaping > Uplink Selection > Load Balancing You have the option of enabled of disabled - do these options only control internet bound traffic not VPN traffic? Reason I ask is that for me, either enabled or disabled it seems to have no effect on traffic travelling over WAN 1 and 2 - but pretty much all of my traffic is VPN. I have suspicions that some of the traffic on my SD WAN is traversing a lower quality backup link instead of the primary leased line as i'm getting complaints of slow speeds. How should I set up the uplinks so that SD WAN VPNs only use the primary, and the secondary only comes into force if the primary was to fail? And yes I have tried this option: Do not create VPN tunnels over the secondary uplink unless the primary uplink fails. Which broke connectivity as the MX started complaining that it could not reach the VPN registry Thanks
... View more
Mar 26 2020
9:18 AM
No, all of our MX's were configured as routed with full mesh when first installed
... View more
Mar 25 2020
3:00 AM
That's interesting i wonder if that would work for us better, however it would mean a fairly drastic redesign. I can't see a reason why we couldn't have them in concentrator mode as we have existing FW's at our HQ sites. How does routing work between concentrators, can you set up tunnels between them to retain full connectivity throughout the SD WAN?
... View more
Mar 25 2020
1:42 AM
The default route that you specify on the spoke / having an exit hub isn't enough, in this case i want internet traffic to be forwarded onto the LAN not out onto the internet via the MX which is what happens. Therefore you need another manually created default route on the hub MX to point to the LAN, however this needs to be advertised in the autoVPN otherwise the return traffic is dropped. This was confirmed with packet captures as the traffic is seen leaving the LAN interface on the MX and also the return internet traffic is seen hitting the LAN interface on the MX - then the traffic is dropped, nothing is seen returning on the autoVPN. This is despite there being a valid return route for the return traffic in the routing table. Meraki have confirmed this is expected operation, if the default route is not advertised in the autoVPN.
... View more
Mar 24 2020
9:54 AM
I was worried about the effect of doing this as there would be duplicate routes so how would sites know which to route to? I will try it and report back
... View more
Mar 24 2020
8:31 AM
1 Kudo
Hi If you have the following scenario: Company 1 HQ Company 1 satellite office Company 1 satellite office Company 2 HQ Company 2 satellite office Company 2 satellite office All companies are a part of a Group of companies so communicate with each other over the same SD WAN. The satellite offices need to have an Internet connection which is fire-walled and filtered by an appliance (non meraki) at its respective HQ site. In other words, the internet for the satellite offices needs to be back-hauled to its respective HQ site Company 1 satellite office -> Company 1 HQ and Company 2 satellite office -> Company 2 HQ . I have setup: Company 1 satellite office as SPOKE with default route to HUB Company 1 HQ A 0.0.0.0/0 route on Company 1 HQ MX pointing to the LAN core switch at Company 1 HQ The 0.0.0.0/0 route on the MX is not advertised into the SD WAN as i only want this to affect Company 1 satellite offices, not Company 2 Set up the same for Company 2 sites. What i've found is that this basically doesn't work, the internet bound traffic is routed into the HQ successfully, the traffic returns and hits the LAN side of the MX at which point the MX drops the traffic. I have had a ticket with Meraki over this (however this was raised while all sites were HUBS) but the result was the same, if the 0.0.0.0/0 is not advertised in the VPN, the return traffic is dropped by the MX. In my view I think this should work as the routing is good, however the inherent behaviour of the MX's is to drop the traffic. The workaround currently is to have all internet bound traffic forwarded and filtered at 1 HQ, however for my business this is not desirable. I keep coming back to this to see how it could be achieved. I have even updated some sites to the Beta firmware which includes source based routing functionality however this is still not doing the job, since you can only select source networks that are local to the MX on which you are setting up the source based route!! Any geniuses out there can tell me if this can be done? 😫
... View more
My Top Kudoed Posts
| Subject | Kudos | Views |
|---|---|---|
| 1 | 4248 |
© 2024 Cisco Systems, Inc.
