Thank you @PhilipDAth, really appreciate the response.  I thought so too but it's always good to see if others are seeing the same thing! ... View more

I should have updated the thread - case 08784236, support responded.   The file is benign and Security Center is reporting a Retrospective Malware Detection of wsasme.exe. So it is indeed a false positive ... View more

We had same alert on our MX firewalls wsasme.exe SHA25654fd619d136646c014ca6e270e4a483dce033894c918a462b5a0352290ce95db   Disposition - Malicious | Type - MS_EXE | Size - 5657272 bytes   Ticket I had open with Meraki, response this morning:   Thanks for your response. Yes, I can confirm that you can trust Webroot and wsasme.exe is not a malicious file. Please ignore the alert, and I will close the ticket at this time. Thank you, Kunal Konduru Cisco Meraki Technical Support   Webroot Support response yesterday:   The reason that Joe Sandbox lists for their "Suspicious" file determination (hooking functions) is normal for an Antivirus program. Cisco appears to be marking wsasme.exe as a threat for the same reason, however only Cisco support would be able to confirm this. If you have any further questions about this false positive, we recommend reaching out to Cisco support.   Regards, The Webroot Advanced Malware Removal Team     This is a legitimate Webroot file. Please reach out to Cisco support for further assistance with this false positive.   Regards, The Webroot Advanced Malware Removal Team ... View more

Yes, of course.   Regards ... View more

The output from the second tool you show, whois, does not show where the IP block is in use.  It shows where the company that registered the IP block is based.  This is a very different thing. ... View more

@WarrenG did you manage to find a workaround? i'm in the same dilemma - blocked access to/from china and need to allow one domain... ... View more

@MarcAEC i got a quick response from MaxMind, within a couple of hours that the issue should be fixed in their database "next Tuesday" hopefully that means tomorrow. thanks again for your help!     Dear Requester, We have reviewed and accepted your correction for IP range https://protect-us.mimecast.com/s/LNsiCKrG6YS7NBXuMnKkV?domain=192.124.249.0. The corrected data should appear in next Tuesday’s update. We will not send additional confirmation emails for separate corrections (you have submitted) that are accepted within the next 24 hours. You may check whether your correction was applied via our database or web service online demos: GeoIP2 City Database Demo GeoIP2 City Precision Web Service Demo If you have any questions please contact us at correction@maxmind.com. Sincerely, The Team at MaxMind ... View more

Hey @blind3d , No worries 🙂    So, I'm not sure if it's a naming convention problem, but there were a couple of things that nagged me on the config you sent me.    On the Meraki side, you have a remote ID set to "empty", yet on the Palo Alto's side, your local ID is set to the Palo Alto's IP. I would normally recommend using the ID fields when one of the two sides is behind NAT; on the side where you have NAT you'd want to put the private IP on your uplink interface as your local ID, and you'll need to match it on the remote side with the Remote ID field.    The other thing that I'm a bit confused about is the "IPSec GW" configuration on the Palo Alto side. Is that the essentially a subnet pair? Do you happen to have a screenshot of that section (even a mock one)?   @CCL_CO , in the majority of instances it seems to be a mismatch in either phase 2 configuration or the establishment of the SAs (possibly because of the KB I mentioned above), so there's no one-size fits all solution yet. Could you please share some more details around your configuration (please replace the IP addresses with fake ones!)?    Many thanks!   Giac ... View more

https://community.meraki.com/t5/Security-SD-WAN/Client-VPN-Authentication-on-n109-failing-using-Meraki-auth/m-p/128807#M32047   Check out my post.    Im having the issue where users cant authenticate using cloud auth. ... View more

@ACI_Admin I'd encourage you to get in touch with our Support team as the issue may be different/unrelated to yesterday's events.   Many thanks! Giac ... View more

I'm now in the same boat as you. I just deployed a vMX-M and I can't hit the outside interface to make a VPN connection. I'm on hold with Cisco, but I've deployed at least 5 of these and haven't had this issue. ... View more