@rhbirkelund, Did you manage to redeploy vMX? I faced the same problem and since the only workaround is redeployment I'd like to know if there is a recommended redeployment way. I noticed there were some problems with redeployments end up with the Meraki support team. The vMX is in a production environment in my case and there is not much tolerance to a support ticket response time. ... View more

@PhilipDAth, yes, all have unique subnets. Then return traffic to a spoke from vMX Hub will go directly to this spoke since it has one hop (shorter path), Not through to the on-premise Hub like vMX -> on-premise Hub -> Spoke. ... View more

@PhilipDAth , Do you think I can connect on-premise Hub to Azure vMX Hub? On-premise Hub also has users connected need to go to Azure servers. My concern is return traffic from Azure Servers to Spokes in this case. I assume on-premise Hub will send Spokes' subnets to vMX Hub and Spoke themselves will send their subnets to it as well, and it'll not work in this case. What do you think? ... View more

@Inderdeep I'll check it, but I think my case might be different. One hub connected to the DC for only IP-PBX and spoke-to-spoke communication. The other Hub will be vMX in Azure and connected to servers. I am concerned about return traffic from Azure servers to the Spokes and Hub. ... View more

@PhilipDAth , Actually these ports are connected to Primary and Standby MXs.But MXs connected to a LAN switch, and there is APs working on the same VLAN. These may the macs of the users on these APs. I'll try to find the mac owners. ... View more

@GreenMan We plan to create ipsec tunnel between Hub and Azure Cloud and get the required server resources. Do you see any issue with this solution?   In MX Templates best practices guide it's saying;   "It should be noted that service providers or deployments that rely heavily on network management via API are encouraged to consider cloning networks instead of using templates, as the API options available for cloning currently provide more granular control than the API options available for templates."   Do you know if there is any document that shows how to do cloning with APIs? ... View more

@GreenMan We plan to move servers out of DC (to Azure Cloud) so we don't want to put Hub inside DC. The Head office to DC link will be temp to reach servers in DC during the transition. ... View more

@Bruce Then I don't need to enable OSPF on spokes, that's good news, thank you for that. The Hub I will actually need to put in Head Office and we will have a link to DC from there to reach servers. Over this link Hub will speak OSPF with DC router to announce migrated spokes' subnets that it would learn via autovpn from spokes.   I need to put the MX device in the head office (Hub) in routed (nat) mode actually. I read it should be fine with 80 spokes. Is there any issue you know that I need to consider with nat mode? ... View more

@GreenMan We need to access DC servers, that we need to establish OSPF. But there is a plan to move the servers to the Microfost Cloud first. In that case, I would enable VLANs. We need to move around 80 campuses to Meraki, that's why I plan to use automation during deployment. If I can use a template and change its IP and DHCP settings and deploy new MX, this will ease the deployment, and good to learn and use these skills after deployment as well. ... View more

@GreenMan I can not use Template because of the sd-wan limitation of single vlan. Can I use the same combination with cloning? ... View more

@Bruce, Yes, I need to use OSPF, then single VLAN my only solution. I can see that this is limiting MX functionality comparing VLANs enabled. Because of this, I can not use a template (sd-wan limitation), I need to use Cloning instead. ... View more

@MerakiDave ISP said that they use BGP for MPLS. What is the disadvantage of a 2-armed VPN Concentrator? Can I still use L7 Firewall functions for this Mode? What do I need to sacrifice from? I guess I will need to disable VLAN, what else, do you know? ... View more

@Bruce , Yes, I saw it, thanks. ... View more

Hi @MerakiDave, Can I run BGP route advertisement out of the MX VPN concentrator when it's running in NAT/Routed mode? Can it take all of the remote site routes in the AutoVPN domain via IBGP and advertise them to EBGP neighbor (MPLC CE router)? I read in routed mode EBGP is not supported. ... View more

Hi Bruce,   Yes, return traffic from DC will go from MPLS CE, the provider needs to update this route. I may not do with ospf from mx because Bruce said it's either vlans or ospf on nat mode concentrator, I may need VLANs. Also, he's saying it will not learn routes, that it'll not learn DC servers subnet from MPLS CE router via OSPF. But I can advertise routes to MPLS ce via ospf and configure a static route to the mpls ce for the DC servers. I'll consider this if they support dynamic routing. ... View more

Hi Bruce,   Yes, I plan to configure a separate VLAN interface for the MX and MPLS CE connection and have a static route on mx for DC subnet pointing to MPLS CE. I think you're meaning the switch to MX connection here, yes I'll configure this connection on the MPLS CE vlan (same vlan that LAN devices use) and change their GW to this new vlan interface on MX. Them the lan devices will go to mx then mpls ce router to reach the dc servers. The throughput on the MX should be fine, it's FW throughput is 4G and VPN throughput is 1G. But MPLS throughput possible to be increased since it will be the new gw for the Meraki sites. ... View more

Hi Bruce,   Thank you for your reply and recommendations. MPLS CE already connected to lan switch in production. LAN devices on switch reaching DC servers via MPLS CE. I want to connect 2*meraki mx to the switch(stack) as well for HA, and another link to connect mpls router for routing. And at some point, I'll need to move LAN switch from MPLS CE to Meraki MX and use MPLS CE only for a gateway to the MPLS (DC servers).  I think what you're saying is keep meraki mx as a primary gw and mpls ce as secondary gw for head office devices connected to LAN switch (keep lan sw connected to both meraki mx and mpls ce), seems a good idea. Am I correct? ... View more

Hi, Thanks for your reply. I saw this document. But in my deployment, I need to connect NAT mode vpn concentrator(that's in head office) directly to the internet with 2 uplinks (without core router, sw, or firewall). I want to connect it to a lan switch but to form HA pair only (not for connecting lan devices, I'll move lan devices later from mpls ce router to the meraki vpn concentrator). I need to connect meraki mx to an mpls CE router, to reach DC servers (located in mpls cloud). I need to use static routing on vpn hub to reach dc servers via mpls ce router, since Meraki does not support dynamic routing with another router. Or put a middle router to speak dynamic with the mpls ce and speak static with meraki vpn concentrator. I need meraki spokes to reach DC servers through auto-vpn via vpn concentrator but go to internet for rest via spli tunnel. After that we will move all sites from mpls routers to meraki routers. This is a temp design until servers will move to the cloud. After that all sites will use internet, we'll disable auto-vpn. What do you think, Is it applicable, do you see any problem or any recommendation? Is there any guide for this kind of hub deployment? ... View more