Hello- I inherited two sites that were bound together over a vpn connection. Over the summer, we installed dark fiber to connect the two sites together. These sites were utilizing fairly old Cisco switching, but fairly new datacenter infrastructure and Meraki AP's. Eh, 2 out of 3. Not bad. Site A was 192.168.1.X Site B was 192.168.2.x Datacenter was located at Site A but the datacenter vendor started throwing in 10.x.x.x for the servers, iscsi, etc. in an effort to move to that particular structure. All the ap's and their respective clients are all in the 192's. There is a ton of legacy fire, phone, building automation, access control, etc. that is beyond replacing so the 192's have to stay for budget's sake. I replaced the entire 100 meg and mix of gig switches with Meraki to go end to end including the MX over the summer with little to no problems. The MX is setup with 2 static routes from 192.168.x.x/16 and 10.x.x.x/8 to the next hop dist switch. The dist switch has the default route 0.0.0.0 back to the MX IP. All good. Fast forward. New ISP. Change the IP on the MX interface and only the 192's will work, nothing on the 10.x network. I've rolled the entire network to the release candidates, I've 1:1 nat'd, etc. to no avail. I can setup 1:1 nat, shaping, flow preference, and literally anything I want on the 192 subnet in either building (except if it's wireless) and it works like a champ. Nothing changed except the ISP. I can direct connect to the MX (which is in the 10.x range) and can resolve some sites, but not every site. It's the strangest thing. Anyone ever seen this before? I'm a CLI by trade, I've run some packet captures, the equipment is less than 60 days old, and up until a few hours ago, not a problem at all. It's hard to blame the ISP when you can run a speed test on a workstation and it maxes out at 990 meg... Dist Switch has Layer 3 enabled, maybe 15 or so vlans. All seem to be functioning properly. As soon as I activate the old ISP, everything works as it should. I've restarted DNS services, flushed cache, no content filtering enabled, no ACL, no NAT, No firewall rules. This is very vanilla. I've used Google DNS, my old ISP DNS, new ISP DNS, and everything else. It just stalls loading "some" sites. Others load fine. But you can nslookup and resolve them via command line.
... View more