Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Register or Sign in
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
About eye
eye
Here to help
Member since Jul 30, 2020
Jul 13 2023
Community Record
11
Posts
2
Kudos
1
Solution
Badges
Jun 9 2023
11:49 AM
The hub subnets in this case still need to be advertised to the other MX's which should participate in Auto VPN. The "hub" (spoke) vpn subnets also need to be enabled for the ipsec with non-meraki peers. There are a handful of MX's in the organization which only connect to non-meraki peers in Site A and another site via ipsec tunnel with some identical subnets required between the Auto VPN MX hub and non-meraki ipsec peers. The lack of Auto VPN opt out without also disabling ipsec with non-meraki peers could mean placing MX's in separate organizations is the only solution.
... View more
Jun 8 2023
6:47 PM
nat'ing the Site A MX hub subnets would create more problems than it solves in this environment so won't be an option but the feedback is appreciated. It's odd that non-Meraki vpn peering can be defined/restricted with tags while Meraki Auto vpn peering seemingly can't, yet the "hub" type selection which opens Auto vpn is also the only option for establishing non-Meraki vpn tunnels.
... View more
Jun 8 2023
12:05 PM
Site A = MX hub Site B + C = MX spokes ... Site X + Y = MX "hubs" with only ipsec tunnels to a non-meraki vpn peer via tags in the site to site vpn page Availability column. No meraki peers connect through these. Without creating separate organizations or full tunnel default routing, is there a way for identical or overlapping subnets to coexist in Site A's advertised routes and Private Subnets configured for tagged non-meraki vpn peers used by X & Y?
... View more
Labels:
- Labels:
-
3rd Party VPN
-
Auto VPN
Feb 14 2023
10:20 AM
Are there advantages in having separate networks for each device type (MR, MS, MX) for each location bound to separate templates for each device type rather than single combined networks per location with a combined template?
... View more
Oct 6 2021
4:52 PM
management ip icmp response time spiking on some ms120's in our environment has been observed. Client devices on the access ports haven't seemed impacted so it hasn't been a priority to focus on isolating the cause. Is it correct that there is no support for monitoring cpu/memory utilization in these? It's assumed icmp requests are just getting handled at a lower priority than client traffic until it's looked into further:
... View more
Oct 5 2021
12:33 PM
1 Kudo
Yes, access policy was enabled using Cisco ISE (radius) on most ports. This was configured in ISE as audit only with no blocking to evaluate results. It was necessary to remove those policies from most ports due to a bug (while on 12.17 or 12.28 stable) causing traffic to stop passing on any ports with policy enabled which may still be a factor on 14.x we'll have to revisit: Switch firmware versions MS 12.30 changelog -Bug fixes: Ports with an access policy can fail to grant network access to end devices post-reboot on MS120/125 series switches Switch firmware versions MS 14.31 changelog -Alerts: Clients on a RADIUS authenticated port that ages out of the MAC table due to inactivity will fail to be relearned until a port bounce has occurred (present since MS 14.28)
... View more
Sep 30 2021
11:22 AM
Is is possible to modify the syslog server setting for all switch networks rather than going through each individual network-wide >> general >> logging field?
... View more
Sep 30 2021
11:10 AM
Possibly relevant items noted in recent firmware changelog in case anyone else encounters this: Switch firmware versions MS 14.31 changelog Known issues MS120s on rare occasions will reboot (present since MS 11) Links being established on a MS120 can result in neighboring ports to flap (present since MS 11) MS120s with multiple access policies enabled may reboot when port changes are made
... View more
Jul 30 2021
9:05 AM
Since the original post the approach that stabilized each trouble location was configuring dedicated Meraki switch management vlans with no other devices on those vlans. Our MS120's appear to be sensitive in some way the legacy random brand switches were not.
... View more
Jul 30 2020
4:35 PM
1 Kudo
Yes, lots of Aastra & Yealink poe phones with some locations having both. The switches are generally near employee offices within a climate controlled space but definitely not environments with the level of cooling and air flow we'd find at datacenters. I'll check into logging temperature data either from switch snmp or through external means to get an accurate picture. Changelogs for the upcoming firmwares you mentioned will be revisited. Thanks for the response.
... View more
Jul 30 2020
2:50 PM
Old locally managed switches are being replaced with new meraki (cloud managed) switches at some remote sites. At a few the MS120-48FP sporadically stop responding to remote icmp response monitoring, poe phones and lan go down and return, and when staff on site check the hardware fast enough they often report the fans revving and seeing the LED going through its flashing amber/white cycle repeatedly as though it's booting. Sometimes we have to physically power cycle these to get back to normal. This hasn't been an issue on the old switches that were replaced or those that remain which are a mix of Cisco Catalyst, Cisco Small Business, & other vendors. Other locations that also got the MS120-48FP's have had no problems at all so there may be contributing factors in the environment. Sometimes it happens several times a day, other times a couple weeks go by without trouble reports. Meraki cloud management wan ip exclusions were configured in the firewalls. The problem has persisted from firmware 11.x to the current 12.17. Logging in the meraki management console seems basic with no low level debug or boot info to reference. I'm checking into what's available from snmp in these and setting up mirroring to dump traffic 24/7 to a local wireshark instance at one location to have traffic history if/when it happens again. Are there any known issues or traffic to look for that would cause this behavior on MS120's? Mac/cam/arp table limitations?
... View more
My Accepted Solutions
| Subject | Views | Posted |
|---|---|---|
| 3898 | Jul 30 2021 9:05 AM |
My Top Kudoed Posts
| Subject | Kudos | Views |
|---|---|---|
| 1 | 3653 | |
| 1 | 4511 |
© 2024 Cisco Systems, Inc.
