Exactly, if you have 2960's, you shouldn't be getting this notification, lol.  ... View more

Yup, same here.  ... View more

Well, first thing: can you connect to the 3CX server from inside the network? I assume that you can and all works as intended?    3CX indicates the following ports are used: The mandatory ones to be forwarded are, depending on what you are connecting (see notes in the table): - TCP 5001 or 443 - TCP/UDP 5060 - TCP 5061 - TCP/UPD 5090 - UDP 9000-10999   You can configure these on your MX: Security & SD-WAN -> Configure -> Firewall -> Forwarding rules  ... View more

My experience with Fortinet products has not been great overall. A local VAR who used to sell Nortel started moving their phone systems as a segue into the IP phone market and every single one of these units was a disaster requiring regular reboots even with just plain analog lines connected. With IP (SIP...etc), performance and reliability were even worse.    They then started moving the "next generation" ones and these weren't much better/almost as bad. Support was atrocious and none of these issues were ever resolved. They ended up pulling most of them and replacing with Avaya.    Not long after this the local Mercedes dealer received a pair of Fortinet firewalls to replace a single Juniper SSG. Already being a bit apprehensive of their product I questioned the MSP about this decision and they said "yeah, that's why we sent two, they are still cheaper than a single SSG".    I come from a mostly IOS and ASA background and was looking for something easier to manage remotely with better visibility and Cisco-level reliability. Meraki has been a good fit in that role. While the MX family lacks the complexity and deep configurability of something like FirePower (or even Sophos XG), if it works in your application (and I've found a lot of the time it does), it may be a better fit for some of the reasons @DHAnderson touched-on. Meraki equipment is wickedly simple to keep up-to-date and manage and there's a security benefit to that which needs to be considered. Also, in my experience, Cisco's support is far better.  ... View more

Assuming the Orbi isn't doing 802.1Q, and you only want VLAN4 on Port 5.  Looking at your last two screenshots, you want:   - Port 4, VLAN1 untagged, VLAN4 tagged, because the port this is coming over on from the firewall, which should have 1 untagged, 4 tagged.    - Port 5, VLAN4 untagged, and only that VLAN allowed on the port (currently, you have 1 untagged on that port, 4 tagged). ... View more

OK, so, if you are going to be using Port 4 on both devices to connect each other, and assuming you have the VLAN's setup on the GX50 properly already:   1. On the GX50, set the port mode to "trunk", you can keep VLAN1 as native.  2. On the XS716T setup the VLAN's that you have defined already on the GX50. This is covered on page 130 of your manual: https://www.downloads.netgear.com/files/GDC/XS708T/XS708T_XS716T_UM_EN.pdf 3. On the XS716T you'll be looking to setup the equivalent of the port mode to "trunk", also leaving VLAN1 as native. You may have to just setup the port with VLAN1 as untagged and tag your other VLANs, I don't use much Netgear equipment and some manufacturers use different language.  4. Assuming your Orbi isn't setup to handle VLAN traffic, you want to setup Port 5 as being an access only port with VLAN4 being untagged.    This assumes you want to have different devices connected to different VLAN's on that switch. If the only thing connected to it is going to be that Orbi, then the easiest way is to just set the port on the GX50 to an access port, assign it to VLAN4 and then only VLAN4 traffic will hit the switch. ... View more

Is your netgear switched a managed switch capable of 802.1Q? It needs to be in order to handle VLANs.    To assign different VLAN's to specific ports: 1. Security & SD-WAN 2. Addressing & VLANs 3. Scroll down to "Per port VLAN settings" ... View more

Perfect, so go into AnyConnect Settings and setup AnyConnect, then download and use that client instead. That prevents you from having to deal with Microsoft breaking things with updates, as you use the Cisco AnyConnect client instead.  ... View more

OK, but what model of MX are you running? For example, under Client VPN on my MX64, I see this:  See the AnyConnect Settings tab?  ... View more

Is the MX getting an external IP or is it getting an internal IP from the ISP's equipment?  ... View more

What MX are you running? It shows up on 16.xx release firmwares on supported devices automatically (or at least it is supposed to). You'll see it as a separate tab beside the client VPN tab on the dashboard.  ... View more

I know it's not a "fix", but have you tried just switching to AnyConnect?  ... View more

I'm wondering if it has to do with the 13:38:08 entry with peer port 48571. If that is also not getting forwarded, I suspect traffic can't get through and the connection is dropped. ... View more

Need some more details, as @cmr noted, how are you configuring the 2nd subnet? How are you putting devices on it, changing the access VLAN of the switch port? ... View more

Yeah, think that started with XP, but server OS's typically won't block it (depending on the configuration).  ... View more

Can you ping wired to wired? And as @ww noted, be sure the clients are allowing ICMP responses, Windows 10 blocks them by default.  ... View more

Ahhh, OK, was wondering. I found the Windows client to be more of a pain than it was worth so as soon as I could switch sites to AnyConnect, I did. I expect you'll find the same.  ... View more

Any reason you aren't using AnyConnect?  ... View more

Do you have 443 already configured as a port forward by chance?  ... View more

Probably not the most secure approach, but I suspect you could, under "Site-to-site VPN" then, at the bottom, "site-to-site Firewall" set an allow rule for only the computer/client you want to be able to access the VPN resources then block everything else.  ... View more

Two things: 1. Are you using the latest drivers straight from Intel? If not, might be worth a shot, to see if it makes a difference. 2. I assume you are using the Meraki Client VPN and not AnyConnect? Have you tried AnyConnect?  ... View more

You are quite welcome! Keep me updated.  ... View more

Excellent. I'd have them check CPU usage, as clearly the replacement didn't solve the problem. I went through the same issue, they sent me a new unit, problem continued. I ended up noticing that the interface flaps were happening at the same time that AnyConnect was restarting. I changed the port and then the flaps stopped. When I pointed that out to support, they checked the CPU usage logs and saw that this coincided. ... View more

Do you have any port forwards or anything exposed on the WAN side? I experienced this same issue (all the interfaces flapping) and in my case, it was the CPU spiking to 100%, which was causing a reset of the interfaces. In my case, it was AnyConnect that was getting hammered by bad actors, so I changed what port it was on, which solved the problem.    Do you have a case open with support? They can check the CPU usage to see if that's the culprit.  ... View more