Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Register or Sign in
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
About pumrum
pumrum
Here to help
Member since Jan 5, 2018
Jan 12 2019
Community Record
9
Posts
2
Kudos
0
Solutions
Badges
Jan 5 2019
1:34 PM
I've tried directly connected to the MX with Cat6a, connected to an MS-225-24P with Cat6a which is connected to the MX with Cat6a, and also via WiFi to an MR53 which is connected to the MX with Cat6a. I checked the device policy for the clients I'm using for testing, and they're all "Normal." I don't recall ever using the whitelist feature. Using this as an idea for something to try, I did create a Group Policy, and configured only the bandwidth limit. I initially set it to 10240 Kb/s (no consistency in the units, hrmm) for my iPhone 8 which is connected iPhone>MR>MX>Internet. Voi La! iPhone is limited to 10mbps. I guess this proves that at least my Meraki kit is able to limit bandwidth, but it doesn't solve my issue for two reasons: 1) This seems to be a per-device limit, not an aggregate link limit (for example 10 devices could soak the entire 100mbps, and I want to limit the aggregate to 50) 2) I haven't found a way to apply this policy to wired devices, only WiFi (and per-SSID at that, which is slightly annoying but workable) I'll keep poking. Thanks for the continued ideas
... View more
Jan 5 2019
8:24 AM
Thanks, I'll take a look at that and see if it does what I need. I always try to find the simplest answer to what should be a simple problem, but I'm happy to try anything at this point 🙂 I have an MX-100 with a similar setup but a bigger pipe and I'm seeing the same issue. The MX-100 has a (roughly) 290/270 down/up pipe. I tried restricting it to 100/50 down/up for kicks.... but same results: a laptop directly connected to the MX (no wifi anywhere on the network, only one WAN connected) and I'm still seeing the laptop push full boat through. This isn't just speedtest.net, I also tried transferring data across the SD-WAN via SCP, as well as across the open Internet to a public SFTP. I'll fiddle a bit, but I'm at the point where I may just kick it over to the help desk. I will keep this thread updated with what I hear. Thanks everyone for the responses.
... View more
Jan 1 2019
2:00 PM
Thanks everyone for the notes and suggestions. To add to my OP and answer your questions: Yes, my WAN connection is capable of 100/10 mbps down/up, but this MX is sharing that pipe with another network, and I need to limit the aggregate traffic through the MX to roughly 40/5. The other 60/5 will be consumed by the second network. Yes, there is only one WAN connected. It is hard-wired directly to the Internet connection which is limited to roughly 100/10. There is nothing connected to the WAN2 port All testing was done using a laptop directly connected via Cat6a to the MX-84. WiFi radio is turned off I initially tried putting 40/5 into the dashboard config, and when that didn't work I thought perhaps Meraki was interpreting "Mb/s" as megabytes per second (as Google does) instead of megabits per second. For this reason, I posted the more restrictive config in case my intuition was correct. I have since switched it back to 40/5 Mbps, but am still seeing the MX using the full 100/10 I ran the throughput test on Meraki dashboard and it comes back consistently 67.3 Mbps I tried rebooting the MX appliance, but the results did not change I realize I am on an older software version 13.33 (I have not yet been able to coordinate an upgrade window) - but I didn't see anything relevant in the release notes (for whatever little that's ever worth). I will upgrade as soon as practical to rule that out I'm notorious for missing the obvious, so I figured maybe someone knew of a setting I have to check to enable the traffic shaping. I've poked around the dashboard and documentation for a few hours, but haven't been able to find it. If not, I'll open a help ticket and post the results here. Thanks again for being so responsive - hope everyone is having a great start to the new year!
... View more
Dec 31 2018
9:20 AM
I'm trying to limit the aggregate WAN traffic on my MX-84 to 40 mbps down, 5 mbps up. I converted this to roughly 5 Mb/s and 0.625 Mb/s respectively. I put those values into the SD-WAN & traffic shaping Uplink configuration for WAN1. However, I am still able to far exceed those limits. Configuration: Speed Test: I'm not looking to do a per-device limit, and I'm really hoping to avoid any fancy traffic shaping rules if at all possible. According to the Meraki docs (source😞 Uplink bandwidth settings This option allows you to configure the upload and download bandwidth of the uplinks. This information is needed for traffic load balancing between the active WAN / Internet ports as well as for limiting upload and download traffic through the WAN ports. You can configure WAN 1, WAN 2, and the cellular uplink individually. To configure specific upload and download bandwidths for a particular uplink, click the details button next to that uplink's bandwidth slider. Am I misinterpreting the usage of that screen? Current version: MX 13.33 CONFIG Up to date Thanks!
... View more
May 8 2018
9:13 AM
Yes, that's correct. I see now that SFP+ Twinax is not backwards compatible with SFP ports. The thing that still has me puzzled is that when I plug both ends of the Twinax into the SFP ports on the MX100... the link lights come on. Very weird. In any case, I've got what I need and very much appreciate everyone's help at pointing out the obvious 🙂
... View more
May 2 2018
9:57 PM
I guess that makes sense, assuming the Copper Twinax is not backwards compatible with 1Gbe? What's got me curious is, when I plug the transceiver into two ports on the MX, why do the link lights come on?
... View more
May 2 2018
4:35 PM
I have an MX100 and MS225-24P running the latest stable firmwares (MX 13.28 and MS 9.37). I connected them together with a passive Twinax Cisco SFP-H10GB-CU1M (1 meter copper). I realize it's not officially "supported" - but I've seen other people get it to work, and the weird thing is: If I connect both ends of the Twinax to two ports on the same device, I get link lights (ie. both ends of the cable plugged into the MX, ports light up; both ends of the cable plugged into the MS, ports light up). If I connect one end to the MX and one end to the MS... no lights. I've tried connecting before power on, and connecting after power on. I've tried all combinations of the ports on both devices. I've poked around in the dashboard to see if there was a setting to toggle. No joy. Any ideas?
... View more
Jan 5 2018
1:22 PM
2 Kudos
That did it! I'm 99.999% sure I did exactly that prior, but must have done something slightly wrong last time. For reference, I did the following: Security appliance > Configure > Addressing & VLANs Add a Static Route Name = OpenVPN Subnet = 10.8.0.0/24 Next Hop IP = 192.168.128.3 Active = Always I am staying on the stable firmware for now, will move up to 13 when I'm back on site. thanks again!
... View more
Jan 5 2018
11:48 AM
I have a Linux server running an OpenVPN TUN server directly connected to an MX-84, and the MX is directly connected to the open Internet. The MX is almost entirely out of the box, very little configuration. The Linux laptop is on the default 192.168.128.0/24 subnet, vlan0. When a remote client connects to the OpenVPN server it gets a 10.8.0.0/24 address on a TUN interface. If the remote client attempts to connect to the WAN (Internet), it gets blocked by the MX and there's an error in the event log (MAC masked for privacy): Source IP and/or VLAN mismatch source_client_ip: 192.168.128.3, source_client_mac: XX:XX:XX:XX:XX:XX, source_client_assigned_vlan: 0 last_illegal_ip 10.8.0.8 client_total_illegal_packets 25340 all_total_illegal_packets 44829 last_reported_total The remote client can access other resources on the Linux laptop, but cannot access the outside Internet. I've tried adding a subnet to the MX so it recognizes the 10.8.0.0/24 network. I've added an explicit outbound firewall rule to permit all outgoing traffic from 10.8.0.0/24 to ANY. I've tried changing the VPN client network so that the client gets a 192.168.128.50 address (not currently in use elsewhere on the MX). No luck on any of those. Is there some setting I'm missing so that the MX will allow outbound traffic from two different subnets from the same source MAC? I didn't want to fiddle with too many settings and risk breaking other things I've got running. this is about the only thing I don't have functional at the moment Some relevant settings: Firmware: MX 12.26 Mode = NAT Client Tracking = Track clients by MAC Address (I tried "track by IP" but it says it's not supported for mixed environments - I also have an MR and MS elsewhere on this network) VLANs = disabled (use a single LAN) Unfortunately the Meraki VPN will not suffice, and I can't use a TAP interface either so I can't pass DHCP responsibility through from OpenVPN to Meraki. Happy to provide any other information that may be relevant. Thanks!
... View more
My Top Kudoed Posts
| Subject | Kudos | Views |
|---|---|---|
| 2 | 9407 |
© 2024 Cisco Systems, Inc.
