Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
About FTI-nsutterby
FTI-nsutterby
Here to help
Member since Apr 28, 2020
Jul 22 2021
Community Record
9
Posts
1
Kudos
0
Solutions
Badges
May 6 2021
9:38 AM
Good morning @ww When you say to create a route from side A to side B, is that on the MX or the MS device or both? Keep in mind that I just took this project over from the last employee who quit. It appears that no layer 3 interfaces have been created either to setup a route. I can configure a static route in the MX without issues, though neither devices has any L3 items enabled or in use I should say. Thanks in advance!
... View more
Apr 30 2021
11:40 AM
OK, so this should be relatively easy, but I am having trouble getting the packets to route correctly. We recently swapped out all of our Fortinet products for Meraki devices and are slowly expanding upon that. Firewalls are installed and configured, as well as switch stacks, APs, etc. Site A 192.168.1.XXX network MX84 Firewall MS225-48LP switches Site B 192.168.15.XXX network MX84 Firewall MS225-48LP switches We need to essentially connect the 2 sites together using a wireless point-to-point transparent bridge. I say it is "transparent" because the switches see the link as just a long network cable. I got the wireless link connected and talking back and forth, but the packets don't seem to route correctly. I'm trying to determine if I need to setup a static route from the MX through the MS to the other sites. I have LLDP enabled and can see the switches 'see' each other at both ends, but there are some strange entries into the logs where the clients as Site A are getting DHCP addresses from Site B and vice versa. I need to figure out how to isolate the clients to grab DHCP leases (currently all being done from Windows servers) and tell network A to find network B and backwards, so as to not need to use VPN tunnels to connect them anymore. I had all of this working with my Fortinet products without issues, but I could also assign a faux IP to the port/interface on the other switches/routers, telling the devices how to route the packets through those interfaces. I have read through all the documentation I could find, but was hoping someone more familiar with Meraki in these forums could shed some light on this quicker. Thanks in advance!
... View more
May 19 2020
10:48 AM
Is anyone else monitoring this thread?
... View more
May 14 2020
1:21 PM
Hey Philip, one more thing. In our existing Fortigate (which I'm more used to) config, I can set an IP on the port the wireless link is connected to, on the Meraki it isn't the same. I want to make sure I understand how Meraki is doing the "next hop" for routing in the table. Since the wireless link itself is basically transparent (meaning the only IP address is for management) once you plug it into both devices at each end, it acts as one long wireless network cable. I'm sure this is super easy, but don't want to miss a step. In our existing device we can bind a route to an interface/port. If I replicate the MPLS with auto-vpn failover, would I set the following route? MX84-Corporate is 192.168.1.11 and MX84-Kercher is 192.168.15.1 On MX84-Corporate add static route that says subnet 192.168.15.0/24 next hop = 192.168.1.XX? I'm not sure how to give it a next hop to be honest since there is no IP associated with the link. Would it be easier to create a VLAN for a port on each MX84 and use that for the routing? We have MS225-48LP's at corporate but not at the other site.
... View more
Apr 28 2020
11:38 AM
1 Kudo
Philip, this "faux MPLS" setup looks like it might just be the right solution, kudos sir!
... View more
Apr 28 2020
11:36 AM
That sounds feasible, the problem we have had so far is that when trying to setup a static route with the devices, while also being members of the VPN mesh network, the system argues about subnet overlaps and will not save changes. We have spent quite a bit of time with Meraki tech support on the phone and emails back and forth, including network topology maps, yet have not been provided a solution as simple as you are recommending, but I will give it a shot and see how it works. I agree with you, it really should be much simpler than it has turned out to be. I have never had problems setting this up with all prior devices over the last 10 years - LOL!
... View more
Apr 28 2020
11:29 AM
Both sites have their own respective ISPs connected to the existing firewall/UTM appliances. The reason that we have a FCC licensed wireless PTP link rather than a VPN connection is due to bandwidth requirements. Our existing infrastructure allows a 400Mbps connection between the 2 buildings without any additionally imposed loss to bandwidth as we don't need any security policies to filter or scan between the 2 buildings as packets pass. The buildings have direct connections for SQL database queries for our TMS software applications, along with hourly replication schedules for our server DR environment, which cannot be done with a VPN tunnel easily without packet loss, etc. The 2 buildings are on different subnets as well, as our primary HQ location has pretty much saturated all available IP addresses on the existing class C network as well, which is why we did not extend the exiting network to the other building. I guess a VLAN could be setup and use the ISP at primary HQ site for web traffic, just not the way it was intended to run, especially as we have transitioned into a whole company VOIP system, so concerns would be adding all the extra nodes running traffic over the wireless link and then out to the ISP from the corporate HQ site. Appreciate all the community help and advice here!
... View more
Apr 28 2020
10:19 AM
It is a fairly simple setup, we need all sites (except 2 subnets) to pass VPN traffic between each other. The other 2 main offices have a wireless point-to-point link connecting them and they are not members of VPN tunnels between themselves, yet are members of VPN tunnels to all other offices. Port 1 (physical interface) on our existing firewall of subnet 192.168.1.0/24 has a static IP assigned of 192.168.15.250 Static route is assigned that says destination is 192.168.15.0/24 use port 1 of gateway appliance 192.168.1.11 On the other side, subnet 192.168.15.0/24 we have a static route set that says destination 192.168.1.0/24 next hop is 192.168.15.250 This has been working for years using a combination of Fortigate 100D and/or Zyxel USG210 appliances along with our prior Cisco SA540 devices. Meraki support has not been able to assist in recreating this setup with their devices.
... View more
My Top Kudoed Posts
| Subject | Kudos | Views |
|---|---|---|
| 1 | 3023 |
© 2024 Cisco Systems, Inc.
