Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
About mscotto
Community Record
24
Posts
3
Kudos
0
Solutions
Badges
May 21 2021
8:15 AM
Hey guys I have a complex network question I was hoping someone here can help. Right now we have 2 MX250's in routed mode which go downstream to our cores then down to our l2 access switches. I have a site to site vpn running on the mx 250 (non meraki tunnel) and works great however I want to create another one to another vpc in aws but do not have enough ports. What I do have is a "breakout load balancer" switch upstream which basically each ISP goes into in order to load balance WAN1 and WAN 2.My question is, can I put a spare MX100 firewall upstream from the breakout switch and just put it in vpn concentrator mode to tunnel over both VPN's? The issue I believe I may have is how would I get the one private subnet that needs to route through the vpn which sits at my core router so it would have to go downstream to the breakout, then down to the routed mode firewall then down to the core. Would I need to use any of the 1:1 NAT features the firewall has for any of this? Thanks!
... View more
Apr 8 2021
11:48 AM
1 Kudo
Got it thanks for the update, so far everything seems to have come up I am not sure if it was an issue on the vendors side but I will keep this in mind thank you
... View more
Apr 8 2021
11:48 AM
Correct sorry I should have clarified, I have 8 stacks max in each stack but a total of 9 separate stacks
... View more
Apr 8 2021
11:08 AM
They were not accessible, it basically is a server controlling badge access for employees and it took down the whole badge system. These are physical servers and yes the switches are in stacks I have a total of 9 stacks
... View more
Apr 8 2021
9:59 AM
1 Kudo
Thanks I checked that and the only one that would fit my stack is the ms425 with the large L2 broadcast domain but it does not seem that large according to the traffic.
... View more
Hi All, So here is a weird one, curious to see if this happened to anyone else, I had my MS switches on 12.27 and upgraded to 12.28. As soon as I upgraded two of my servers went down (stopped passing traffic but showed online). Rebooting the switch and server did nothing, the only way to resolve was to revert back to 12.27. Meraki support did not really have an answer for me so I was curious to see if anyone ran into an issue like this?
... View more
Mar 18 2021
6:24 AM
Hey guys, if I want to deploy a site to site vpn between two mx's (particular one on site MX and the other a vMX in AWS) can I have them sit in routed mode or would I have to change this to VPN Concentrator mode? I am hoping I can leave in routed mode because that is how my deployment is running right now but figured I would check here. Thanks!
... View more
Mar 4 2021
12:47 PM
Hey guys can anyone tell me if you had experience with the z3 teleworker and what it exactly does? Is it just a really enhanced vpn where you can connect to the office wifi and use all the security features through the mx tunneled to a home? Also does it physically have to connect to a home router or can it use wifi to connect?
... View more
Feb 10 2021
5:52 AM
I want to know if this is possible.... Here is my current setup now.. I have a site to site vpn running great from our office to AWS so we can access servers in our vpc. Right now I have the two uplinks to the firewall using the VIP address rather than the mx uplink ip's so if the firewall fails it heads to the backup using that shared ip so the tunnel does not break. Here is my goal..... Give that each ISP gave me 5 static public ip's i was wondering if i can create multiple VPN's, so i would use the second vpn pointing to another vpc in aws. Can I do this by using the mx uplink IP's and creating more vpn tunnels using the same isp? For example wan 1 and wan 2 each have their own public IP on firewall 1 and same scenario for firewall 2. So if that is the case can I then create 4 site to site vpn tunnels if need to be? I basically want to know if I can create more than one vpn with a different ip from the same ISP. Thanks!
... View more
Feb 2 2021
3:55 AM
Thanks Joe, last question, so the static entries I get, however is the point to only trust those ports and then not trust anything else? I have end users having issues with wifi and it only gets better when i whitelist them to the snooping table. This was before I had the AP's as trusted. I am worried about users who connect via ethernet to a vlan and the same issue happens. I feel like I have to end up trusting every port which defeats the purpose of DAI unless I missed something?
... View more
Anyone running DAI? I enabled this and had serious issues with slowness in the network. I whitelisted the entries to the snooping tables which helped once I allowed the legit traffic. My ports that are trusted are all the uplinks to the core however I was told that I need to also trust anything with a static entry such as AP's ports on the switch as well as servers printers etc? Is this true? I want to re enable this feature but I am kind of worried since it caused so many issues. Thanks!
... View more
Jan 28 2021
7:01 AM
Can anyone tell me if I would have any use of traffic shaping policies if I only have one site with a full meraki stack? I do have a site to site vpn built to aws but nothing meraki to meraki. I want to enable autovpn and use those policies but I am not sure it would work for just one single site?
... View more
Jan 28 2021
7:00 AM
Hi Thanks this is very helpful! I was wondering if I put my MX's in concentrator mode how I would take care of the routing aspect this clears that up!
... View more
Jan 20 2021
2:34 PM
Hi All, Does anyone know if it is possible to do eBGP on two MX 250's with both my ISP's? My ISP's said it is possible if I have the right gear. I want to know if I need to throw in a Cisco ISR to sit in front of the MX in order to do this or I can do it straight from the MX's (preferred way). I assume if so I would need to throw them in one arm concentrator mode? I currently have my MX in routed mode so if I move this to VPN concentrator (if this is the way to do it) how will this change my current routing setup? Thanks!
... View more
Oct 23 2020
4:58 AM
This would be just one location. So if I understand correctly, I go wirth the vmx100 and that is a cloud mx that sits in my VPC and then I can do more meraki to meraki configurations? I assume this will sit at the edge of the vpc and route all incoming and outgoing traffic?
... View more
Oct 23 2020
4:56 AM
Got it that makes more sense, I wanted to do routing so it seems like BGP would be more robust for this. Thanks!
... View more
Oct 22 2020
2:18 PM
Got it thank you, im trying to understand the difference between that and BGP, would BGP be more route specific and load balancing does not handle routes?
... View more
Oct 22 2020
2:17 PM
Got it thanks so it sounds like the vmx100 makes more sense than going the direct connect route?
... View more
Oct 22 2020
9:24 AM
It is in routed mode. If I moved to one arm concentrator I assume I would have to change all my routing in terms of having the core switches do NAT and DHCP?
... View more
Oct 22 2020
7:45 AM
I have two ISP's right now however I do not have load balancing enabled. Do you guys know if load sharing will accomplish the same thing as BGP? Are any of you running BGP on your MX's and do you experience any issues?
... View more
Oct 22 2020
7:44 AM
Hello, I have a site to site vpn from the local office mx going to AWS VPC. I was looking into setting up AWS direct connect so I can do BGP however, would adding a vMX accomplish the same goal or is that completely separate? I guess I am looking for the difference between the two. Thanks!
... View more
My Top Kudoed Posts
| Subject | Kudos | Views |
|---|---|---|
| 1 | 3015 | |
| 1 | 3049 | |
| 1 | 1639 |
© 2024 Cisco Systems, Inc.
