@jcolley    I would capture the traffic from the Inside Interface to see the latency.   At the beginning of the 3-way TCP handshake, you will see the latency of SYN-ACK packet.   You can calculate the real world throughput by TCP-Windows-Size/Latency = Throughput   http://bradhedlund.com/2008/12/19/how-to-calculate-tcp-throughput-for-long-distance-links/     Also, if you have 0.4% of packet loss, you will lose 50% of your  throughput. https://blog.thousandeyes.com/a-very-simple-model-for-tcp-throughput/ ... View more

Can you ping URLs, such as, www.google.com  or www.vmware.com      If you can, could you run tracetcp to verify which hop is broken?  tracetcp will trace the tcp port as tracert does on ICMP.   ... View more

@benny    Are you using  Hub BGP and DC BGP router with iBGP or eBGP? ... View more

I had the same issue. You will have to have at least 3 usable IP addresses.   1 for each Meraki, and 1 for VIP. I ended up changing my /30 to /29 subnet.   ... View more

@JackInSights    Have you requested to turn on IKEv2 on your network?   "Please note that IKEv2 is only supported on MX Security Appliances that are running firmware version 15.12 or higher. This version of IKE must also be enabled by Cisco Meraki support in order to function."] ... View more

@roshangkr    Please don't fall into the Meraki Marketing trap. The max number of connected device by Meraki is very tight. I have over 100 clients on MX64 w/o any performance issue.    If need to count clients, you need to add the # of   PCs, Laptops, Desk IP Phones, Printers, Switches, APs, and AP Clients altogether.      What matters is your CPU usage during  the business hour.     =MX84 with 166 Clients == ... View more

Hi Miyo360,   1) I would create the Shanghai subnet(192.168.120.0/24) on HongKong Meraki so that it gets advertised to London Office.   2) You need a static route on HongKong Meraki toward WireguardVPN      If Dest is 192.168.120.0  then go to 192.168.110.8    3) For return  traffic, you need a static route on Wireguard VPN    if Dest is 192.168.100.0/22 then go to 192.168.110.1   ... View more

I was trying to do the same thing with the entire subnets for O365 w/o success. It's just too much.   https://help.webex.com/en-us/WBX264/How-Do-I-Allow-Webex-Meetings-Traffic-on-My-Network   Maybe Webex is not that bad..   64.68.96.0/19 (CIDR) or 64.68.96.0 - 64.68.127.255 (net range) 66.114.160.0/20 (CIDR) or 66.114.160.0 - 66.114.175.255 (net range) 66.163.32.0/19 (CIDR) or 66.163.32.0 - 66.163.63.255 (net range) 170.133.128.0/18 (CIDR) or 170.133.128.0 - 170.133.191.255 (net range) 173.39.224.0/19 (CIDR) or 173.39.224.0 - 173.39.255.255 (net range) 173.243.0.0/20 (CIDR) or 173.243.0.0 - 173.243.15.255 (net range) 207.182.160.0/19 (CIDR) or 207.182.160.0 - 207.182.191.255 (net range) 209.197.192.0/19 (CIDR) or 209.197.192.0 - 209.197.223.255 (net range) 216.151.128.0/19 (CIDR) or 216.151.128.0 - 216.151.159.255 (net range) 114.29.192.0/19 (CIDR) or 114.29.192.0 - 114.29.223.255 (net range) 210.4.192.0/20 (CIDR) or 210.4.192.0 - 210.4.207.255 (net range) 69.26.176.0/20 (CIDR) or 69.26.176.0 - 69.26.191.255 (net range) 62.109.192.0/18 (CIDR) or 62.109.192.0 - 62.109.255.255 (net range) 69.26.160.0/20 (CIDR) or 69.26.160.0 - 69.26.175.255 (net range) ... View more

Hi Miyo360,   So you're trying to get to Shanghai office through ShanghaiVPN(WireguardVPN)?   Then traffic will first hop on AutoVPN then,WireguardVPN?   ... View more

This is what Meraki tech support replied to my ticket.   The name you mentioned looks like a MDNS hostname learnt by the Dashboard. This happens when the client is reporting a hostname via MDNS packets and this overrides the NetBios and DHCP Hostname that might have been configured on the client device.   To mitigate this issue, there are a couple of things that can be looked into:   1) Verify where the MDNS hostname is configured and change it to any expected hostname that needs to be on the Dashboard.   2) Stop MDNS services on the client device so that it does not update the MDNS hostname on Dashboard.   3) Manually update the client device's hostname using the following instructions: https://documentation.meraki.com/MX/Monitoring_and_Reporting/Rename_a_Client_Hostname Hostname broadcasted by MDNS gets priority over DHCP and NetBios and hence, the hostname gets updated when the client sends MDNS traffic. Let me know if you have any questions.   I don't know where  to start to stop the mDNS service on Windows 10 machines. 😞 ... View more

That's what I'm experiencing as well. ... View more

Netflow and syslog use the "Highest VLAN ID".   Let say you have vlan 1 -192.168.1.1 vlan 101 - 10.2.70.4, vlan 999-172.16.150.1   If you can reach all of the vlans from your syslog/netflow server, source IP will be 172.16.150.1     If your syslog/netflow server is at a remote location, and vlan 999 is not reachable, then source IP will be 10.2.70.4         ... View more

I think it is the "highest VLAN ID", which can communicate through either LAN or Site-to-Site VPN. ... View more

Got it. Since your Meraki and Syslog server are passing packets within the LAN subnets, then the sending interface will be the VLAN interface with the lowest IP address.   If your Meraki is at a remote site, syslog traffic will pass through Site-to-Site VPN Interface with either the lowest SVI IP or external IP address. ... View more

Hi 🙂 Whether you're impressed or not, please set up your syslog with Roles "Flows" and capture the udp==port 514 from your syslog server. You will see the source IP address. I didn't say that Meraki sends the syslog over the Internet. They just put all the syslog packets under the sourcing IP of the portal. ... View more

the real IP address that your Syslog server will see is the IP address of Meraki Portal.   In my case, 6.78.245.4. ... View more

and please run debug ip bgp and debug ip tcp transactions as well.     ... View more

can you capture packets on the BGP Interface? I am curious how MX handles eBGP with a multihop. ... View more

Please configure multihop on your CORE RT.    Since eBGP always assumes the neighbor router  is only one hop away, TTL of one.     https://networklessons.com/bgp/ebgp-multihop   ... View more

Hi,   I had two Internet connections for HQ and each branch office. ASA injects redistributed static route to the core switch, or you can create a generic branch office subnet(10.10.0.0/16) toward ASA.   Then create more specific static route (10.10.10.0/24 for Branch A, 10.10.20.0/24 for Branch B) to Meraki whenever you switch over onto it. That how I did for 80+ branches.  However, if I could do it again, I would set up a MX100 on a transparent mode so that I could use OSPF.     ... View more

We will have to see your debug to identify which phase is breaking up. ... View more

I found the flow prioritization is ineffective or not working when I wanted to fix the VoIP call quality. You will have to limit other traffic flows under certain % of your given bandwidth from ISP ... View more

I found a couple of links to identify the public subnets but there are two many.   You can download the list of subnets from here . https://www.microsoft.com/en-us/download/details.aspx?id=53602   And these people were trying to identify the actual subnets that belong to the windows updates.   https://social.technet.microsoft.com/Forums/windows/en-US/b596aa81-2775-496c-b159-dcfc5c5bf22d/windows-update-ip-addresses-range-and-subnet-mask-for-windows-server-2008?forum=winserversecurity   So I'm thinking these are the subnets for the window updates. 65.52.0.0/14 70.37.0.0/17 70.37.128.0/18 94.245.64.0/18 111.221.16.0/20 111.221.64.0/18 132.245.0.0/16   157.54.0.0/15 157.56.0.0/14 157.60.0.0/16 207.46.0.0/16 207.68.128.0/18 213.199.128.0/18 ... View more