Do you have access to an older Cisco switch that for sure doesn't have EEE? I'm using a stack of 2960S's at a client and they definitely don't have it and they are rock solid.  ... View more

I believe it's the same as whatever it was for the Meraki VPN client, so if that was 500, then that's what it is for AnyConnect.  ... View more

A number of different connection types, one is wireless (cellular) but was previously on wireless P2P, others are cable and DSL.    My 150 option is set to the tftp server I have running at the HO in this system which has the handset configs and phone firmware loads on it.    One thing you might want to check is to ensure that there's no firewall rules blocking access from the remote subnets to your TFTP server.  ... View more

As long as you have your option 150 set properly in the DHCP server at the remote site, it should just "work", at least mine do.  ... View more

OK, thank you. There are two things that will cause a flap: 1. 100% CPU spikes, but these, in my experience, flap all the active interfaces 2. Energy Efficient Ethernet being enabled on a non-Meraki switch or router. This is a known issue.    What is the make/model of the switch you are using between the ISP and the MX?  ... View more

When I had an MX84 hitting 100% and flapping the interfaces, it was all the interfaces that were active. If you are only seeing the WAN interface flap, I'd suspect it isn't a crash, as all should flap under a crash as well.  ... View more

If there was no route to your new IP, you'd have no internet on that device. Are these straight-up modems or is it possible that the device got reset and is now in modem/gateway mode? Even if the external routable IP didn't change in that scenario (Appliance Status -> WAN1 would still show the correct external IP) of course the MX would be unreachable, but could still get to the internet. What do you see under Appliance Status -> Uplink -> WAN1 ?  ... View more

I had to get the CPU utilization figure from support. In my case, I had all active ports flapping, not just the WAN links, so if you are only seeing it on the WAN side I'd assume the issue isn't the same. Just figured I'd mention it. ... View more

Are other ports on it flapping at the same time or just the WAN port?  ... View more

May not be germane to your issue but I figure I'd mention it:  On a client's MX84 I was seeing frequent flaps of not only both uplinks but also the active LAN ports. Turns out the AnyConnect service was getting hammered by malicious actors and spiking the CPU to 100%, which caused the flap. Moving AnyConnect to a different port solved the problem.  ... View more

This would be something to bring up with Cisco directly, not Meraki, as the AnyConnect client is really more ported to Meraki rather than it being a development platform. If you have an AnyConnect license, you can submit a ticket through the conventional Cisco TAC support channel.  ... View more

Looks like two different countries (China, Russia). But the volume is just a trickle now compared to when it was on 443. I haven't seen any hits on it today for example. This client is a car dealership, so yeah, definitely no business in those countries, lol.    Also, no further flaps of course, since AnyConnect isn't getting hammered now.  ... View more

Yes, I'll be reaching out to Rogers (the ISP) and seeing what they can do in terms of blocking this traffic.    The few I traced were China, FWIW.  ... View more

Yep, exactly, and it seems like this particular network is being targeted, at least that's my theory based on what I see in the logs for it vs my other MX84's with AnyConnect.    Would be really nice with some form of geoblocking for this service. This particular unit only runs Enterprise, so it doesn't have any of the advanced protection stuff or L7.  ... View more

Interestingly, my MX64 has shown AnyConnect as being available (and I tested it, it worked) since the 16.xx betas.    I'm not on 17.xx yet and I see this on the client VPN screen:   ... View more

Heard back from support this AM. @Make_IT_Simple you may find this amusing, they suggested the same thing as you about EEE being enabled. These are older 2960S models, EEE isn't available (the sh eee status command doesn't even work) and I advised them accordingly.   I also made it a point to mention the AnyConnect port change, as this AM? No flap. We'll see what the rest of the week brings but I've suggested they start looking there in terms of a potential cause.  ... View more

You are quite welcome!  ... View more

Looks like he will have to contact Telstra and have them add a data code to his SIM, as I found this:     ... View more

Will do, that's the purpose of this thread. I thought it was quite an interesting issue and I'm not seeing it on my two other MX84's, both with AnyConnect, but neither of them are getting hammered on 443 like this one was. Both have the same fibre service too, conveniently.    I'll update tomorrow whether it happens in the morning or not. It seems to happen most frequently around 9:20-9:40AM based on the logs, but can also happen later in the day again.  ... View more

I have 4x 2960's behind it, one as a 3x stack, one as a standalone for a separate network. There's also a cheap Trendnet PoE 100Mbit switch that runs an Aruba AP for guest WiFi on its own VLAN and it uses a rate limited WAN link on WAN2 at 10Mbit.    None of the 2960's have energy efficiency enabled and the MX flaps ALL the active ports at once, which you can see in the screenshot, that includes both WAN links (which are connected to an Alcatel/Lucent ALU for fibre) and all three LAN links.    This only started in February that I can see from the logs, the equipment has been the same for at least a year and AnyConnect was only enabled near the end of last year. ... View more

Based on one of the earlier posts, it sounds like yes, there needs to be a config change by support so that it actually uses that APN in practice.  ... View more

Good point on the NAT, I can see a 10.10---- in his screenshot where he edited out the cellular IP address.  ... View more